The vulnerability is in the Casdoor 2.356.0 webhook URL handler. A specially crafted request allows an attacker to trigger a server‑side request forgery (SSRF), causing the Casdoor server to send arbitrary HTTP requests to any target. This could enable data exfiltration, interaction with internal services, or redirection to malicious endpoints. The flaw is classified as CWE‑918.

Casdoor version 2.356.0 is the only affected product. No other versions or product variants are indicated in the data, so installations running this exact version are vulnerable.

The CVSS base score of 5.1 indicates a medium impact, and the EPSS score of less than 1 % suggests that exploitation is unlikely at present. The vulnerability is not listed in the CISA KEV catalog. The description explicitly states the attack can be launched remotely. It does not state whether authentication to the webhook endpoint is required, so the potential exposure may vary based on deployment configuration. Overall risk depends on what internal services can be reached via the SSRF and how exposed the webhook endpoint is.