CVE-2025-61524

{
  "id": "CVE-2025-61524",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-08T19:15:44.720",
  "lastModified": "2026-11-05T22:10:00.203",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login"
    },
    {
      "lang": "es",
      "value": "Un problema en el módulo de verificación de permisos y la interfaz de edición de organizaciones/aplicaciones en Casdoor v2.26.0 y versiones anteriores, y corregido en la v.2.63.0, permite a administradores remotos autenticados de cualquier organización dentro del sistema eludir el mecanismo de verificación de permisos del sistema concatenando directamente URLs después de iniciar sesión."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-08T19:28:54.356127Z",
          "id": "CVE-2025-61524",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/casdoor/casdoor/releases/tag/v2.63.0",
      "source": "[email protected]"
    },
    {
      "url": "https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}