CVE-2026-15630

EUVD-2026-48418
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.9 CRITICAL
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 17.72%
Common Weakness Enumeration
References
https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz
https://www.kb.cert.org/vuls/id/889462
https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz