The vulnerability in Casdoor (CVE-2026-9094) affects versions prior to 2.387.0. The GetTokenExchangeToken function validates JWT signatures but fails to verify that the token's user is part of the same organization as the target application. This missing cross-organization check enables attackers to exchange tokens across organizations, leading to unauthorized privilege escalation. The issue is classified under CWE-269 (Improper Privilege Management) and CWE-863 (Incorrect Authorization). The CVSS 3.1 vector indicates a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows attackers to bypass organizational boundaries by exchanging JWT tokens across organizations, resulting in privilege escalation. This can lead to unauthorized access to resources and actions within other organizations, severely compromising confidentiality, integrity, and availability of affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor the Casdoor project for updates addressing this vulnerability. Until a fix is available, restrict token exchange functionality and enforce manual verification of organizational boundaries where possible.