A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...

zetlyn/cve-ghsa vulnerability ghsa GHSA-c4rm-6cjv-h5vw cve CVE-2026-105307 known 2026-10-05

https://github.com/advisories/GHSA-c4rm-6cjv-h5vw

Properties

cvss

cvss	7.3 receipt Source GitHub advisories Its words `7.3` Read by `field:cvss.score` Said since 2026-10-05 18:22 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-105307", "cvss": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 5.5, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "ghsa_id": "GHSA-c4rm-6cjv-h5vw", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw", "identifiers": [ { "type": "GHSA", "value": "GHSA-c4rm-6cjv-h5vw" }, { "type": "CVE", "value": "CVE-2026-105307" } ], "nvd_published_at": "2026-10-05T12:17:09Z", "published_at": "2026-10-05T12:31:27Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-105307", "https://vuldb.com/cve/CVE-2026-105307", "https://vuldb.com/submit/951430", "https://vuldb.com/vuln/413512", "https://vuldb.com/vuln/413512/cti", "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...", "type": "unreviewed", "updated_at": "2026-10-05T12:31:34Z", "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw", "vulnerabilities": [], "withdrawn_at": null }
cwe	CWE-287 receipt Source GitHub advisories Its words `CWE-287` Read by `field:cwes[].cwe_id` Said since 2026-10-05 18:22 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-105307", "cvss": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 5.5, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "ghsa_id": "GHSA-c4rm-6cjv-h5vw", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw", "identifiers": [ { "type": "GHSA", "value": "GHSA-c4rm-6cjv-h5vw" }, { "type": "CVE", "value": "CVE-2026-105307" } ], "nvd_published_at": "2026-10-05T12:17:09Z", "published_at": "2026-10-05T12:31:27Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-105307", "https://vuldb.com/cve/CVE-2026-105307", "https://vuldb.com/submit/951430", "https://vuldb.com/vuln/413512", "https://vuldb.com/vuln/413512/cti", "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...", "type": "unreviewed", "updated_at": "2026-10-05T12:31:34Z", "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw", "vulnerabilities": [], "withdrawn_at": null }
severity	medium receipt Source GitHub advisories Its words `medium` Read by `field:severity` Said since 2026-10-05 18:22 UTC Last answered 2026-10-06 13:46 UTC Original open at the source What the source handed over { "comments": 0, "credits": [], "cve_id": "CVE-2026-105307", "cvss": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_severities": { "cvss_v3": { "score": 7.3, "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" }, "cvss_v4": { "score": 5.5, "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X" } }, "cwes": [ { "cwe_id": "CWE-287", "name": "Improper Authentication" } ], "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "ghsa_id": "GHSA-c4rm-6cjv-h5vw", "github_reviewed_at": null, "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw", "identifiers": [ { "type": "GHSA", "value": "GHSA-c4rm-6cjv-h5vw" }, { "type": "CVE", "value": "CVE-2026-105307" } ], "nvd_published_at": "2026-10-05T12:17:09Z", "published_at": "2026-10-05T12:31:27Z", "references": [ "https://nvd.nist.gov/vuln/detail/CVE-2026-105307", "https://vuldb.com/cve/CVE-2026-105307", "https://vuldb.com/submit/951430", "https://vuldb.com/vuln/413512", "https://vuldb.com/vuln/413512/cti", "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw" ], "repository_advisory_url": null, "severity": "medium", "source_code_location": "", "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...", "type": "unreviewed", "updated_at": "2026-10-05T12:31:34Z", "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw", "vulnerabilities": [], "withdrawn_at": null }

7.3

receipt

Source: GitHub advisories
Its words: 7.3
Read by: field:cvss.score
Said since: 2026-10-05 18:22 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-105307",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-c4rm-6cjv-h5vw",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c4rm-6cjv-h5vw"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-105307"
    }
  ],
  "nvd_published_at": "2026-10-05T12:17:09Z",
  "published_at": "2026-10-05T12:31:27Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-105307",
    "https://vuldb.com/cve/CVE-2026-105307",
    "https://vuldb.com/submit/951430",
    "https://vuldb.com/vuln/413512",
    "https://vuldb.com/vuln/413512/cti",
    "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T12:31:34Z",
  "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "vulnerabilities": [],
  "withdrawn_at": null
}

cwe

CWE-287

receipt

Source: GitHub advisories
Its words: CWE-287
Read by: field:cwes[].cwe_id
Said since: 2026-10-05 18:22 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-105307",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-c4rm-6cjv-h5vw",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c4rm-6cjv-h5vw"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-105307"
    }
  ],
  "nvd_published_at": "2026-10-05T12:17:09Z",
  "published_at": "2026-10-05T12:31:27Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-105307",
    "https://vuldb.com/cve/CVE-2026-105307",
    "https://vuldb.com/submit/951430",
    "https://vuldb.com/vuln/413512",
    "https://vuldb.com/vuln/413512/cti",
    "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T12:31:34Z",
  "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "vulnerabilities": [],
  "withdrawn_at": null
}

severity

medium

receipt

Source: GitHub advisories
Its words: medium
Read by: field:severity
Said since: 2026-10-05 18:22 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

What the source handed over

{
  "comments": 0,
  "credits": [],
  "cve_id": "CVE-2026-105307",
  "cvss": {
    "score": 7.3,
    "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
  },
  "cvss_severities": {
    "cvss_v3": {
      "score": 7.3,
      "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
    },
    "cvss_v4": {
      "score": 5.5,
      "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
    }
  },
  "cwes": [
    {
      "cwe_id": "CWE-287",
      "name": "Improper Authentication"
    }
  ],
  "description": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "ghsa_id": "GHSA-c4rm-6cjv-h5vw",
  "github_reviewed_at": null,
  "html_url": "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "identifiers": [
    {
      "type": "GHSA",
      "value": "GHSA-c4rm-6cjv-h5vw"
    },
    {
      "type": "CVE",
      "value": "CVE-2026-105307"
    }
  ],
  "nvd_published_at": "2026-10-05T12:17:09Z",
  "published_at": "2026-10-05T12:31:27Z",
  "references": [
    "https://nvd.nist.gov/vuln/detail/CVE-2026-105307",
    "https://vuldb.com/cve/CVE-2026-105307",
    "https://vuldb.com/submit/951430",
    "https://vuldb.com/vuln/413512",
    "https://vuldb.com/vuln/413512/cti",
    "https://github.com/advisories/GHSA-c4rm-6cjv-h5vw"
  ],
  "repository_advisory_url": null,
  "severity": "medium",
  "source_code_location": "",
  "summary": "A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the...",
  "type": "unreviewed",
  "updated_at": "2026-10-05T12:31:34Z",
  "url": "https://api.github.com/advisories/GHSA-c4rm-6cjv-h5vw",
  "vulnerabilities": [],
  "withdrawn_at": null
}

Text

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the... A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.