CVE-2025-4210
Published: 02 May 2025
Summary
CVE-2025-4210 is a medium-severity Improper Authorization (CWE-285) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, ranked in the top 6.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A critical vulnerability was discovered in Casdoor versions up to 1.811.0 within the HandleScim function of the controllers/scim.go file, specifically in the SCIM User Creation Endpoint component. The issue stems from improper authorization checks that permit manipulation of SCIM requests, classified under CWE-285 and CWE-639, and carries a CVSS 4.0 score of 6.9 reflecting network-accessible impact without authentication.
Remote attackers with no prior privileges can exploit the flaw to bypass authorization controls and perform unauthorized actions such as user creation through the SCIM endpoint. The attack requires no user interaction and can be launched directly over the network against exposed instances.
The official fix is provided by upgrading to Casdoor 1.812.0, which incorporates patch commit 3d12ac8dc2282369296c3386815c00a06c6a92fe. Public references including the GitHub release tag v1.812.0 and VulDB entries confirm the remediation details and commit that resolves the authorization bypass. The EPSS score remains flat at 0.1027 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13124
Vulnerability details
A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated…
more
remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The control mandates authorization decisions for each access request, reducing the ability to exploit improper authorization weaknesses.
The control requires checking and applying authorization decisions per policy, preventing improper authorization.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
The control's documentation requirement reduces improper authorization by ensuring only mission-justified actions bypass authentication.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.