CVE-2026-91998

Executive Summary

CVE-2026-91998 is a critical authorization bypass (CWE-863) in Casdoor through version 4.4.0, exposed via the /api/mcp endpoint. An attacker who possesses any single application's valid clientId/clientSecret pair can obtain unrestricted user-administration privileges across all organizations managed by the same Casdoor instance, enabling bulk data theft (including password salts and email addresses) and full Create/Read/Update/Delete control over user records. With a CVSS base score of 9.9 and scope-change impact to confidentiality, integrity, and availability, any multi-tenant Casdoor deployment used for SSO or IAM is at severe risk.

Technical Analysis

Casdoor is an open-source Identity and Access Management (IAM) / SSO platform written primarily in Go. In a typical deployment it acts as the central OIDC/OAuth2 identity provider for many downstream applications ("organizations" in Casdoor nomenclature), each with its own set of users, administrators, and credentials.

The vulnerability resides in the /api/mcp endpoint. The NVD description states that this endpoint accepts a caller's application credentials — a clientId and clientSecret — and, upon validating them, grants the holder "unrestricted access to user administration across all organizations." The core defect is a broken authorization check: the endpoint validates that the supplied credentials are valid for some application, but fails to scope the resulting session to the organization to which that application belongs. Because the Casdoor data model places all organizations in a single logical tenancy on the same instance, a credential from Organization A effectively unlocks administrative operations over Organizations B, C, D, and so on.

This is a classic horizontal-to-vertical privilege escalation that also crosses the tenancy boundary, which is why the CVSS vector carries S:C (Scope Changed). The confidentiality, integrity, and availability impact metrics are all High (C:H/I:H/A:H), reflecting that the endpoint exposes both sensitive read data (password salts and email addresses, explicitly named in the description) and privileged write primitives (create administrator accounts, modify users, delete users in any organization). Collecting password salts is particularly dangerous because it transforms a targeted account compromise into an offline credential-cracking or pass-the-hash opportunity if hashes can be reconstructed, facilitating lateral movement back into the victim's downstream applications.

The attack surface is network-reachable (AV:N), requires only low privilege (PR:L) — the attacker merely needs any legitimate application credential, which is often distributed to third-party integrations, contractors, or low-trust internal tools — and requires no user interaction (UI:N).

Exploitation Scenarios

No public PoC or Nuclei template exists for this issue, so the attack chain below is inferred from the vulnerability class (broken access control / authorization bypass) and the exact behavior documented in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Casdoor instance by fingerprinting the /api/mcp endpoint or the /api/ surface (e.g., https://target.example.com/api/mcp). Casdoor's default UI and API paths (/login, /api/...) are widely recognizable, and Shodan dorks targeting the product or its favicon can enumerate candidates.

2. Obtain any low-privilege application credentials. The attacker acquires a clientId/clientSecret pair belonging to any one application registered in the instance. Sources include a legitimate but low-trust integration, leaked configuration in a public repository, an over-permissive SaaS connector, or credentials shared with a contractor. Crucially, this pair does not need to belong to an administrative application.

3. Trigger the authorization bypass. The attacker sends a request to /api/mcp supplying their valid clientId and clientSecret. Because the endpoint validates only that the credentials exist, and does not enforce organization scoping, the attacker's session is treated as an authorized administrator of every organization on the instance. The response grants administrative access to user-management functionality.

4. Post-exploitation impact. With effective super-admin rights, the attacker can:

   • Enumerate user records across all organizations, harvesting email addresses for phishing and password salts for offline cracking/hash-reconstruction attacks.
   • Create new administrator accounts, establishing persistence that bypasses the original credential and survives rotation of the compromised application.
   • Modify existing users — e.g., reset passwords or change email/ownership fields to hijack accounts across tenants.
   • Delete users to cause denial of service, destroy audit trails, or cover tracks. The scope-change rating reflects that compromise of one application spills into every downstream SSO-integrated application and every tenant organization.

Impact Assessment

Impact is severe and enterprise-wide. A Casdoor instance typically sits at the center of an organization's authentication fabric; compromise of it is effectively compromise of the SSO provider, and therefore of every application and tenant that trusts that IdP.

• Confidentiality (High): Attackers can read user records across all organizations, including password salts and email addresses (explicitly named in the advisory). This exposes the entire user directory and hands attackers material useful for offline credential attacks.
• Integrity (High): Attackers can create administrator accounts and modify or delete existing users anywhere, allowing persistent, hard-to-detect identity manipulation.
• Availability (High): Bulk deletion of users or organizations' users can render downstream applications inaccessible.
• Scope (Changed): The vulnerable component (one application's credentials) affects resources beyond its security authority (all other organizations). A single low-value integration becomes a master key to the entire IAM deployment.

Organizations with multi-tenant Casdoor deployments (MSPs, SaaS providers offering SSO, enterprises with many business units) face the largest blast radius. Even single-tenant deployments are exposed if they host more than one "organization" internally.

Detection Guidance

Sigma Rule

title: Potential Casdoor Authorization Bypass via /api/mcp
id: 8f3c2b1a-9d4e-4c7a-b2f1-3e5d6a7c8b90
status: experimental
description: Detects repeated or anomalous access to the Casdoor /api/mcp endpoint that may indicate exploitation of CVE-2026-91998 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91998
author: valtersit.com
date: 2026-01-01
logsource:
  category: web
  product: generic
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/mcp'
  selection_method:
    cs-method: 'POST'
  selection_status:
    sc-status: 200
  condition: selection_endpoint and selection_method and selection_status
falsepositives:
  - Legitimate MCP integrations
level: high

YARA Rule

rule CVE_2026_91998_Casdoor_MCP_AuthBypass
{
    meta:
        description = "Detects HTTP requests targeting the Casdoor /api/mcp endpoint associated with CVE-2026-91998"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91998"
        date = "2026-01-01"
    strings:
        $ep  = "/api/mcp"
        $cid = "clientId"
        $cs  = "clientSecret"
        $ct  = "Content-Type: application/json"
    condition:
        any of ($ep) and any of ($cid,$cs)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-91998 Casdoor /api/mcp Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/api/mcp"; nocase; http.header; content:"Content-Type|3a 20|application/json"; nocase; classtype:attempted-admin; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91998; sid:202691998; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST" and
   url.path == "/api/mcp"]
  [network where network.protocol == "http" and http.request.method in ("POST","PUT","DELETE") and
   url.path : ("/api/*" )]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/api/mcp" method=POST status=200
| stats count values(src_ip) as src_ips values(uri_path) as paths by src_ip
| where count > 5
| table src_ip count src_ips paths

Wazuh OSSEC Rule

<group name="web,casdoor,cve-2026-91998,">
  <rule id="2026919" level="12">
    <if_sid>31100</if_sid>
    <id>^/api/mcp</id>
    <description>CVE-2026-91998: Possible Casdoor /api/mcp authorization bypass attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91998,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source, OSV, claims a patch; this is not independently confirmed). No vendor advisory, fixed version, or workaround is officially documented at the time of writing. Treat any "fix" as unverified until Casdoor publishes an advisory and release notes.

1. Immediate mitigations (interim):

   • Restrict network access to /api/mcp at the reverse proxy/WAF/load balancer — block it from untrusted networks or disable the endpoint entirely if it is not operationally required.
   • Rotate all application clientId/clientSecret credentials, prioritizing any that are shared with low-trust integrations, contractors, or public repositories.
   • Enforce strict organization scoping in front of Casdoor: only allow a given application credential to reach the APIs of its own organization via WAF rules or an authenticating proxy.
   • Audit logs for anomalous access to /api/mcp and for unexpected admin-account creation or user modifications.
   • Export and review current user listings for unauthorized administrator accounts created via MCP.

2. Patch / upgrade steps:

   • Monitor the official Casdoor repository and advisory channels for a version that explicitly fixes CVE-2026-91998. Do not assume "post-4.4.0 = fixed" without vendor confirmation.
   • Once a confirmed fixed version is available, upgrade, then re-verify that /api/mcp enforces organization scoping.
   • After upgrade, rotate all credentials once more and invalidate administrative sessions.

3. Long-term hardening:

   • Adopt a defense-in-depth model where every API endpoint performs explicit object-level and tenant-level authorization rather than relying on a single credential check.
   • Apply the principle of least privilege to application credentials: a per-application credential should only ever touch that application's own organization.
   • SIEM-alert on identity-provider anomalies: new admin accounts, bulk user enumeration, mass deletes, and off-hours MCP usage.
   • Maintain an inventory of every service holding Casdoor credentials and review quarterly.

References

• NVD — CVE-2026-91998: https://nvd.nist.gov/vuln/detail/CVE-2026-91998
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• OSV (single claimed patch source; not independently confirmed): https://osv.dev
• Casdoor project repository and advisory channel (monitor for fixed-version confirmation)
• CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-91998 is not listed at time of writing)

Threat actor / exploit-in-the-wild status: No public PoC, Nuclei template, or known exploitation campaign is documented. EPSS is 0.00417 (35.5th percentile). All exploitation scenarios above are inferred from the documented vulnerability class and the NVD description.