Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2025-61524 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a
• https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd

Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2025-61524 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://gist.github.com/DevHjz/e75cea851d48e5f5478ac2a90757851a
• https://github.com/casdoor/casdoor/commit/d883db907bb6e0b95737ef8e8b57b7da9078cbdd