CVE-2026-105307

HighCVSS 7.3/10Last modified Oct 5, 2026

Description

A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them CVE-2026-1053117.7The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s CVE-2026-1053129.9A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag CVE-2026-1053147.5Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file CVE-2026-1053154.7A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsear CVE-2026-1053167.1The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available CVE-2026-1053178.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.CVE-2026-1053187.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newslette CVE-2026-105322.9Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-core) modules) allow CVE-2026-1053225.3The Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, all CVE-2026-1053249.2An HTTP header injection vulnerability in start-page-loader.cgi of ADM allows an unauthenticated remote attacker to read arbitrary files on CVE-2026-1053262.5An argument injection flaw was found in CUPS. When email notification is configured, the CUPS scheduler accepts printer subscription request