What happened
Casdoor, an identity platform that ships its own MCP server for agent integrations, contains an authorization-bypass flaw in the /api/mcp endpoint: any valid application credential pair grants unrestricted administrative access to user records across every tenant/organization on the instance, rather than being scoped to that application's own users.
Why it matters
Casdoor is used as a centralized SSO/IAM layer, increasingly fronting MCP-based agent access; a bypass here doesn't just leak data from one tenant — it hands an attacker with minimal, easily obtained credentials full admin control (including password data) over every organization on the instance, making this a single point of catastrophic multi-tenant compromise for any AI agent ecosystem relying on Casdoor for identity.
Attack vector
The /api/mcp endpoint fails to properly scope authorization to the calling application. An attacker who holds any single application's clientId and clientSecret (including a low-privilege or self-service-registered app) can use the MCP interface to gain unrestricted user-administration access across all organizations tenant-wide, including enumerating user records with password/credential material.
Affected systems
Casdoor (through 4.4.0) — AI-native Identity and Access Management (IAM)/SSO platform with built-in MCP server
Mitigation
Upgrade past the affected 4.4.0 baseline once a fixed Casdoor release is available; in the interim, restrict which applications may call /api/mcp and audit all clientId/clientSecret pairs for unintended administrative scope.