A missing authentication check in the Casdoor upload-resource API allows an unauthenticated attacker to send a POST request to the /api/upload/resource endpoint and upload arbitrary files. The flaw exists in the controllers/resource.go module and is present in all Casdoor releases up to version 4.0.0. Because the uploaded file is stored on the server without verification, the vulnerability permits malicious content to reach the application’s file system, creating the potential for code execution or unauthorized data exposure, depending on how the uploaded file is handled later.

Casdoor versions 4.0.0 and earlier are affected. The vulnerability resides in the open‑source Casdoor authorization server’s file upload component. No patched version is documented in the available data, so customers must verify whether a newer release adds authentication checks to the upload endpoint.

The CVSS score of 6.9 classifies the issue as moderate. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. However, a publicly disclosed exploit indicates that attackers could leverage the flaw. Attackers can trigger the issue from any network location that can reach the API, and the missing authentication means that the upload can occur without credentials.