Description
A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
References (3)
Core 3
Core References
Vdb Entry vdb-entry
VDB-355073 | Casdoor Webhook URL server-side request forgery
https://vuldb.com/vuln/355073
Signature, Permissions Required signature
permissions-required
VDB-355073 | CTI Indicators (IOB, IOC)
https://vuldb.com/vuln/355073/cti
Third Party Advisory third-party-advisory
Submit #781771 | Casdoor v2.356.0 Server-Side Request Forgery
https://vuldb.com/submit/781771
Scores
CVSS v3
4.7
EPSS
0.0030
EPSS Percentile
21.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-918
Status
published
Products (3)
None/Casdoor
2.356.0
casbin/casdoor
2.356.0
casdoor/casdoor
0Go
Published
Apr 03, 2026
Tracked Since
Apr 03, 2026