CVE-2026-15630

CriticalCVSS 9.9/10Last modified Sep 22, 2026

Description

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-639 CWE-863

Affected software

Vendor	Product	Versions
Casdoor	Casdoor	< v4.2.0

References

Timeline

Published: Jul 23, 2026
Last modified: Sep 22, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1563110.0Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against CVE-2026-156346.5IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTT CVE-2026-156377.5Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authent CVE-2026-156389.1An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cr CVE-2026-156399.3An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the at CVE-2026-15644.8Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high p CVE-2026-156409.5Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.CVE-2026-156417.1Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg CVE-2026-156423.3Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.CVE-2026-156437.3AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS CVE-2026-156446.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attri CVE-2026-156456.4The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribu