Casdoor Authorization Bypass Bug

Casdoor versions up to 4.4.0 contain a serious vulnerability.

Attackers can exploit the /api/mcp endpoint to gain full access to user administration across all organizations.

This allows them to enumerate user records, create administrator accounts, modify existing users, and delete them.

All it takes is legitimate credentials from a single application.