Casdoor - Information Disclosure (CVE-2025-4210)
Description
A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.
psychologyCrowdSec Analysis
CVE-2025-4210 is a critical vulnerability in Casdoor up to version 1.811.0 that allows remote attackers to bypass authorization via the SCIM User Creation Endpoint. Exploiting this flaw could enable unauthorized access to sensitive user information or unauthorized user creation, posing significant risks to affected systems. Upgrading to version 1.812.0 is strongly recommended to mitigate this issue.
CrowdSec has been tracking this vulnerability and its exploits since 11th of February 2026.
Data from the CrowdSec community indicates that exploitation of CVE-2025-4210 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-4210 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-4210 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Attackers exploit this vulnerability by sending unauthenticated requests to endpoints such as /scim/v2/Users or /api/scim/v2/Users, bypassing authorization controls to access sensitive SCIM user data.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-05-02 |
| Rule Released | 2026-02-11 |
| CrowdSec First Seen | 2026-02-11 |
Related Weaknesses
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.