A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) an…
Critical CVSS 9.9
Summary
A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz
- https://www.kb.cert.org/vuls/id/889462
- https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz
Timeline
- nvd_ingest NVD