{"id":"CVE-2026-15630","aliases":["EUVD-2026-48418","GHSA-jhfj-h4g6-q9h9"],"status":"published","title":"CVE-2026-15630","description":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).","severity":{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00469,"percentile":0.41061,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269","CWE-639","CWE-863"],"published":"2026-07-23T19:57:48Z","modified":"2026-09-22T21:17:29Z","products":[{"vendor":"casdoor","product":"casdoor"}],"references":[{"url":"https://vokecyber.com/research/cve-2026-15630-casdoor-cross-tenant-authz","tags":["exploit"]},{"url":"https://www.kb.cert.org/vuls/id/889462"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15630"},{"url":"https://github.com/advisories/GHSA-jhfj-h4g6-q9h9"}],"sources":{"cve":[{"id":"CVE-2026-15630","title":"CVE-2026-15630","description":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).","status":"published","published":"2026-07-23T19:57:48.908Z","modified":"2026-09-22T20:40:09.069Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-863","CWE-269","CWE-639"],"updated_at":"2026-11-02T13:47:39.876248Z"}],"euvd":[{"id":"EUVD-2026-48418","description":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).","status":"published","published":"2026-07-23T19:57:48Z","modified":"2026-09-22T20:40:09Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T17:28:01.71506Z"}],"ghsa":[{"id":"GHSA-jhfj-h4g6-q9h9","title":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or...","description":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).","status":"published","published":"2026-07-23T21:31:02Z","modified":"2026-09-03T21:32:16Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:11:20.583896Z"}],"nvd":[{"id":"CVE-2026-15630","description":"A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).","status":"published","published":"2026-07-23T21:17:02.76Z","modified":"2026-09-22T21:17:29.893Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-269","CWE-639","CWE-863"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}