Casdoor versions 2.362.0 and earlier allow a token exchange mechanism that verifies JWT signatures but fails to check that the token’s user belongs to the same organization as the target application. An attacker can therefore trade a token from one organization for a token in another, gaining elevated permissions and access to resources beyond their own organization. This flaw enables an escalated role within a different organizational context without any additional credentials.

Casdoor is the affected product. All installations running version 2.362.0 or earlier are vulnerable. These are the publicly available releases of Casdoor up to and including 2.362.0.

The vulnerability carries a high risk of privilege escalation. The CVSS score is 9.8, indicating a critical level of severity. The EPSS score is < 1%, and it is not listed in CISA KEV, suggesting no known active exploitation yet. The likely attack vector is any user who can obtain a valid JWT from a source organization and call the GetTokenExchangeToken endpoint. An attacker does not need additional special privileges beyond credentialting an organization user, making exploitation relatively straightforward once the token exchange path is identified.