CVE-2026-90942CWE-863broken-access-control

CVE-2026-90942

Critical · published September 14, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
19.1
In the wild
Unconfirmed
What it is

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization, including global administrators.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
EPSS
0.00277 · 19.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-14T22:20Z
References (5)
https://github.com/casdoor/casdoor · [email protected]https://github.com/casdoor/casdoor/blob/v4.4.0/controllers/cert.go · [email protected]https://github.com/casdoor/casdoor/blob/v4.4.0/object/cert.go · [email protected]https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-3-organization-admin-can-read-the-global-built-in-jwt-signing-private-key-via-apiget-certs-and-apiget-cert-incomplete-fix-of-3003--enables-cross-organization-token-forgery · [email protected]https://www.vulncheck.com/advisories/casdoor-through-4.4.0-private-key-exposure-via-certificate-endpoints · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 17:52Z
    Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
    cvelistv5