Casdoor Cross-Site Request Forgery vulnerability

published 2023-06-22 3 y ago modified 2026-06-17 4 mo ago also GHSA-rwcp-qrwg-56cg , EUVD-2023-1883

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.1%; EPSS 3.1% chance of exploitation in 30 days, percentile 87%
public exploits: 3; Exploit-DB

Casdoor v1.331.0 and below was discovered to contain a Cross-Site Request Forgery (CSRF) in the endpoint /api/set-password. This vulnerability allows attackers to arbitrarily change the victim user's password via supplying a crafted URL.

Timeline

2023-06-22 Published
2024-04-02 First public exploit (EDB-51961)

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 23 mo ago (2024-12-04)

Exploit prediction

3.07% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-52439 Casdoor 2.95.0 - Cross-Site Request Forgery (CSRF) webapps, 2025-10-29
EDB-52432 Casdoor 2.55.0 - Cross-Site Request Forgery (CSRF) webapps, 2025-09-16
EDB-51961 Casdoor < v1.331.0 - '/api/set-password' CSRF webapps, 2024-04-02
github.com https://github.com/casdoor/casdoor/issues/1531 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
GitHub	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/casdoor/casdoor	<=1.331.0	no fix listed

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

github.com /casdoor/casdoor/issues/1531
web, exploit, issue-tracking, third-party-advisory
casdoor.org /
product
gist.github.com /omriman067/4e90a3a4ffa40984f011d8777a995469
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2023-34927
advisory
casdoor.org
web
github.com /casdoor/casdoor
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary