CVE-2026-84423CWE-287CWE-306

CVE-2026-84423

High · published September 2, 2026

CVSS v3.1
7.3
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

A vulnerability has been found in Casdoor up to 4.0.0. This affects an unknown function of the file controllers/resource.go of the component upload-resource API. Such manipulation leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00693 · 52.3th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-09-02T03:17Z
References (7)
https://github.com/casdoor/casdoor/ · [email protected]https://github.com/casdoor/casdoor/issues/5617 · [email protected]https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-1-unauthenticated-arbitrary-file-upload-via-apiupload-resource · [email protected]https://vuldb.com/cve/CVE-2026-84423 · [email protected]https://vuldb.com/submit/883037 · [email protected]https://vuldb.com/vuln/397791 · [email protected]https://vuldb.com/vuln/397791/cti · [email protected]
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 22:45Z
    Casdoor upload-resource API resource.go missing authentication
    cvelistv5