CVE-2026-108572
Casdoor Proxy Validation cas.go CasP3ProxyValidate server-side request forgery
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate of the file controllers/cas.go of the component Proxy Validation. Such manipulation of the argument pgtUrl leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 4.11.0 is able to address this issue. The name of the patch is 03c6c9aaa2eda5b085ce128ce0d60b34094efbd9/ada08ecd10cbf158f593dee23a8bab63efecf995. It is advisable to upgrade the affected component.
| CWE | CWE-918 |
| Vendor | n/a |
| Product | casdoor |
| Published | Oct 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a casdoor
Be the first to know when new medium vulnerabilities affecting n/a casdoor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / Casdoor
3.164 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 4.9 4.10.0
References
vuldb.com: https://vuldb.com/vuln/416229 vuldb.com: https://vuldb.com/vuln/416229/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108572 vuldb.com: https://vuldb.com/submit/954813 github.com: https://github.com/casdoor/casdoor/commit/03c6c9aaa2eda5b085ce128ce0d60b34094efbd9 github.com: https://github.com/casdoor/casdoor/releases/tag/v4.11.0 github.com: https://github.com/casdoor/casdoor/
Credits
🔍 pngyuo (VulDB User) VulDB Vulnerability Moderation Team