CVE-2026-9094: CVE-2026-9094

Synopsis

This is an authentication bypass and privilege escalation vulnerability in Casdoor, an open-source identity and access management platform. The flaw is reachable over the network with no authentication required, as derived from the CVSS vector (AV:N, PR:N). A remote attacker can exchange a valid JWT from one organization to obtain a token scoped to a different organization, crossing tenant boundaries and gaining unauthorized access to resources, data, or administrative functions within the target organization. No fix version has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable token exchange endpoint is exposed over the network, so an attacker must be able to reach the Casdoor service via standard network connectivity.

• AuthenticationNot required

  No credentials or existing session are needed; the attacker supplies only a valid JWT issued by any organization within the same Casdoor instance.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator to succeed.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker only needs a legitimately issued JWT from any organization, with no race conditions or environmental factors to navigate.

Blast Radius

• A successful attacker reads data and resources belonging to an arbitrary target organization within the Casdoor instance, including user records, application configurations, and any secrets the identity platform exposes via its API.
• The attacker can modify organization-scoped data, including user roles, application settings, and access-control rules, by operating under the forged cross-organization token.
• Because the attacker obtains a fully valid token for the target organization, they can disable accounts, revoke legitimate sessions, or lock administrators out of their own organization.
• The confidentiality, integrity, and availability of every tenant sharing the same Casdoor deployment are affected, making this a full multi-tenant boundary break.