CVE-2026-5469: Casdoor Webhook URL server-side request forgery

Published Apr 3, 2026

Updated

A weakness has been identified in Casdoor 2.356.0. This vulnerability affects unknown code of the component Webhook URL Handler. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

1 affected component

Casbin Casdoor=2.356.0

Event History

Apr 3, 2026

CVE Published

via MITRE·02:30 PM

Data Sourced

via MITRE·02:30 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeaknessAffected Software

Feb 13, 58282

Event

via FIRST·11:58 AM

Frequently Asked Questions

What is the severity of CVE-2026-5469?

CVE-2026-5469 has been classified as a high severity vulnerability due to the potential for server-side request forgery attacks.

How do I fix CVE-2026-5469?

To mitigate CVE-2026-5469, it is recommended to upgrade Casdoor to the latest version that addresses this vulnerability.

What components are affected by CVE-2026-5469?

CVE-2026-5469 specifically affects the Webhook URL Handler component of Casdoor version 2.356.0.

Can CVE-2026-5469 be exploited remotely?

Yes, CVE-2026-5469 can be exploited remotely, making it a significant risk for exposed servers.

What type of attack can CVE-2026-5469 facilitate?

CVE-2026-5469 can facilitate server-side request forgery attacks, allowing attackers to manipulate server requests.