A vulnerability has been found in Casdoor up to 4.0.0. (CVE-2026-84423)
Description
A vulnerability in Casdoor up to version 4.0.0 affects the upload-resource API in the controllers/resource.go file, leading to missing authentication. This flaw allows remote attackers to exploit the system without proper authentication. The vulnerability has a CVSS 3.1 score of 7.3, indicating a medium severity. The vendor has not provided a patch or response and has deleted the related GitHub issue. Public exploit details have been disclosed.
CVSS v3.1
Score 7.3high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-84423 is a vulnerability in Casdoor versions up to 4.0.0 involving an authentication bypass in the upload-resource API component (controllers/resource.go). This allows remote attackers to perform actions without authentication. The vulnerability is categorized under CWE-287 (Improper Authentication). The vendor has not issued any patch or official advisory and has not responded to early disclosure attempts. The vulnerability has been publicly disclosed with exploit details available.
Potential Impact
The vulnerability allows remote attackers to bypass authentication controls in the upload-resource API, potentially leading to unauthorized access and actions. The CVSS score of 7.3 reflects a moderate impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.
Mitigation Recommendations
No official patch or remediation has been provided by the vendor. Users should monitor vendor channels for updates and consider restricting access to the affected API endpoint as a temporary measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ghh7-j2mm-r3r8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-84423"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a984567acd9273b496aca9e
Added to database: 09/02/2026, 15:48:55 UTC
Last enriched: 09/07/2026, 22:23:17 UTC
Last updated: 10/18/2026, 06:48:20 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.