CVE-2026-15630 - Vulnerability Details - OpenCVE

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact total

Vendors	Products
Casdoor	Casdoor

No data.

No data.

References

Link	Providers
https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz

History

Sun, 02 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-285

Mon, 27 Jul 2026 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-639 CWE-863
Metrics		cvssV3_1 `{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sun, 26 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-269 CWE-285

Fri, 24 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Casdoor Casdoor casdoor
Vendors & Products		Casdoor Casdoor casdoor

Thu, 23 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Description		A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
Title		CVE-2026-15630
References		https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz

MITRE

Status: PUBLISHED

Assigner: certcc

Published: 2026-07-23T19:57:48.908Z

Updated: 2026-07-27T16:30:10.478Z

Reserved: 2026-07-13T17:35:29.688Z

Link: CVE-2026-15630

Vulnrichment

Updated: 2026-07-27T16:29:11.272Z

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15630", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "state": "PUBLISHED", "assignerShortName": "certcc", "dateReserved": "2026-07-13T17:35:29.688Z", "datePublished": "2026-07-23T19:57:48.908Z", "dateUpdated": "2026-07-27T16:30:10.478Z"}, "containers": {"cna": {"title": "CVE-2026-15630", "descriptions": [{"lang": "en", "value": "A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body)."}], "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Casdoor", "product": "Casdoor", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "v3.115.0", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "references": [{"url": "https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz"}], "x_generator": {"engine": "VINCE 3.0.43", "env": "prod", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15630"}, "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-23T19:57:48.908Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-863", "lang": "en", "description": "CWE-863 Incorrect Authorization"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "references": [{"url": "https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz", "tags": ["exploit"]}], "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T16:29:47.895568Z", "id": "CVE-2026-15630", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:30:10.478Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-15630", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-27T16:29:47.895568Z"}}}], "references": [{"url": "https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T16:29:11.272Z"}}], "cna": {"title": "CVE-2026-15630", "source": {"discovery": "UNKNOWN"}, "affected": [{"vendor": "Casdoor", "product": "Casdoor", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "v3.115.0"}]}], "references": [{"url": "https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz"}], "x_generator": {"env": "prod", "engine": "VINCE 3.0.43", "origin": "https://cveawg.mitre.org/api/cve/CVE-2026-15630"}, "descriptions": [{"lang": "en", "value": "A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body)."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-863 Incorrect Authorization"}]}, {"descriptions": [{"lang": "en", "description": "CWE-269 Improper Privilege Management"}]}, {"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "37e5125f-f79b-445b-8fad-9564f167944b", "shortName": "certcc", "dateUpdated": "2026-07-23T19:57:48.908Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15630", "state": "PUBLISHED", "dateUpdated": "2026-07-27T16:30:10.478Z", "dateReserved": "2026-07-13T17:35:29.688Z", "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b", "datePublished": "2026-07-23T19:57:48.908Z", "assignerShortName": "certcc"}, "dataVersion": "5.2"}