Vulnerability · Published May 2, 2025 · Assigned by VulDB

CVE-2025-4210Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization

High 7.3

In plain English

A high-severity authorization bypass via user-controlled key in Casdoor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)1.8%top 21.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/casdoor/casdoor	1.812.0	GHSA-8w8f-h4cm-c4pg
Go	github.com/casdoor/casdoor	no fix listed	GO-2025-3661

Affected products (as reported)

Vendor	Product	Versions
n/a	Casdoor	1.811

Weakness: CWE-639, CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

VDB-307180 | Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization vdb-entry, technical-description
VDB-307180 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
Submit #556201 | Casbin Casdoor v1.430.0-v1.812.0 Authorization Bypass third-party-advisory
https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe patch
https://github.com/casdoor/casdoor/releases/tag/v1.812.0 patch