Vulnerability DatabaseCVE-2025-4210

CVE-2025-4210:
vulnerability analysis and mitigation

Overview

A critical vulnerability (CVE-2025-4210) was discovered in Casdoor versions up to 1.811.0 on May 2, 2025. The vulnerability affects the HandleScim function in the controllers/scim.go file, specifically in the SCIM User Creation Endpoint component. This security flaw allows remote attackers to bypass authorization controls (VulDB, GitHub Commit).

Technical details

The vulnerability is related to an authorization bypass in the SCIM User Creation Endpoint. The endpoint lacks proper authentication middleware, allowing unauthenticated attackers to create admin accounts. The vulnerability has received a CVSS v3.1 Base Score of 7.3 (HIGH) and is classified under CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-285 (Improper Authorization) (VulDB).

Impact

The vulnerability affects the confidentiality, integrity, and availability of the system. An attacker can create unauthorized admin accounts without authentication, potentially gaining full administrative access to the Casdoor system (VulDB).

Mitigation and workarounds

The vulnerability has been fixed in Casdoor version 1.812.0. The fix was implemented through patch 3d12ac8dc2282369296c3386815c00a06c6a92fe. Organizations using affected versions should immediately upgrade to version 1.812.0 or later (GitHub Release, VulDB).

Community reactions

According to security researchers, attempts to responsibly disclose the vulnerability were met with resistance. The developers reportedly issued a silent fix and responded to Discord communications by removing the reporter from their channel (VulDB Submit).

Additional resources

Source: This report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues

Cloud threat landscape

A comprehensive threat intelligence database of cloud security incidents, actors, tools and techniques

PEACH

A step-by-step framework for modeling and improving SaaS and PaaS tenant isolation

Get a personalized demo

Ready to see Wiz in action?

“Best User Experience I have ever seen, provides full visibility to cloud workloads.”

David EstlickCISO

“Wiz provides a single pane of glass to see what is going on in our cloud environments.”

Adam FletcherChief Security Officer

“We know that if Wiz identifies something as critical, it actually is.”

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo