{"cve":"CVE-2025-4210","nvd":{"published":"2025-05-02T16:15:36.743","modified":"2026-06-17T09:32:46.417","status":"Deferred","description":"A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","score":7.3},"cwes":["CWE-285","CWE-639"],"references":["https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe","https://github.com/casdoor/casdoor/releases/tag/v1.812.0","https://vuldb.com/?ctiid.307180","https://vuldb.com/?id.307180","https://vuldb.com/?submit.556201"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:01:22.920403922+00:00"},"epss":{"cve":"CVE-2025-4210","score":0.01822,"percentile":0.78776,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-8w8f-h4cm-c4pg","url":"https://osv.dev/vulnerability/GHSA-8w8f-h4cm-c4pg","summary":"Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor","modified":"2025-05-06T20:11:59.653901Z","packages":[{"ecosystem":"Go","name":"github.com/casdoor/casdoor","purl":"pkg:golang/github.com/casdoor/casdoor","ranges":["<1.812.0"],"fixed":["1.812.0"]}]},{"id":"GO-2025-3661","url":"https://osv.dev/vulnerability/GO-2025-3661","summary":"Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor","modified":"2026-03-03T04:56:33.339380Z","packages":[{"ecosystem":"Go","name":"github.com/casdoor/casdoor","purl":"pkg:golang/github.com/casdoor/casdoor","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}