An authorization bypass vulnerability in Casdoor versions up to 4.4.0 allows authenticated attackers to gain unrestricted administrative control over user records across all organizations.

This vulnerability exists in the /api/mcp endpoint due to improper authorization checks. An attacker possessing valid clientId and clientSecret credentials for any single application can bypass intended security boundaries to enumerate, create, modify, or delete user accounts across the entire platform.

The potential for unauthorized administrative access poses a critical risk to data integrity and identity management. An attacker could exfiltrate sensitive user data, such as email addresses and password salts, or establish persistent backdoors by creating new administrator accounts. Given the CVSS score of 9.9, this vulnerability represents a near-total compromise of the identity provider's security model, which could lead to widespread unauthorized access across all systems integrated with Casdoor.

Immediate Action: Update Casdoor to the latest available version as soon as a patch is released by the vendor. In the absence of an immediate patch, restrict access to the /api/mcp endpoint at the network or application firewall level if it is not required for daily operations.

Proactive Monitoring: Review access logs for the /api/mcp endpoint, specifically looking for anomalous requests originating from application-level credentials that attempt to access resources outside of their assigned organization.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and block requests to /api/mcp that do not conform to expected patterns or that attempt to traverse organization boundaries.

Public Exploit Available: Yes, a published PoC exists, attributed to the security researcher's technical write-up provided in the references.

The severity of this flaw cannot be overstated, as it effectively nullifies the multi-tenancy security model of the Casdoor platform. Organizations utilizing Casdoor should prioritize auditing their current deployment and prepare to apply the vendor-provided patch immediately upon its release to prevent potential full-scale identity compromise.