Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-91998 · Microsoft / collected KEV context

cve-program · CVE-2026-91998

• https://github.com/geo-chen/oss/blob/main/casdoor.md#finding-2-application-credential-authorization-bypass-in-apimcp-enables-unrestricted-cross-organization-user-administration
• https://github.com/casdoor/casdoor/blob/v4.4.0/authz/authz.go#L174-L176
• https://github.com/casdoor/casdoor/blob/v4.4.0/routers/base.go#L122-L154
• https://github.com/casdoor/casdoor/blob/v4.4.0/mcpself/user.go
• https://github.com/casdoor/casdoor
• https://www.vulncheck.com/advisories/casdoor-through-4.4.0-cross-organization-user-administration-via-api-mcp

No related operational record is retained in the current change model.