This vulnerability affects Casdoor 2.356.0's Webhook URL Handler, where an attacker with high privileges can remotely manipulate the component to perform server-side request forgery. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, no user interaction, and limited impact on confidentiality, integrity, and availability. The vendor was contacted but did not provide any response or patch. No official remediation or mitigation details have been published.

Successful exploitation could allow an attacker with high privileges to cause the Casdoor server to make unauthorized requests to internal or external systems, potentially leading to information disclosure or interaction with unintended network resources. The impact on confidentiality, integrity, and availability is rated as low to limited. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should restrict access to the Webhook URL Handler component and limit privileges to trusted users only. Monitor for unusual request patterns related to webhook usage. Avoid exposing the vulnerable version to untrusted networks until a fix is released.