CVE-2026-47339: Apache APISIX Authorization Bypass in authz-casdoor Plugin

Technical summary

CVE-2026-47339 is an Incorrect Authorization vulnerability (CWE-863) stemming from improper credential validation in the authz-casdoor authentication plugin. An authenticated attacker can exploit default plugin configuration to authenticate using credentials originating from an unintended authentication source, effectively bypassing intended authorization boundaries. The vulnerability requires the attacker to already possess valid credentials and network access to the APISIX instance, but does not require special privileges or user interaction. The flaw exists in APISIX release branch 2.14.1 through 3.16.0.

Business impact

This vulnerability creates a privilege escalation and lateral movement risk for organizations using APISIX with the authz-casdoor plugin in production. An insider or compromised account holder could authenticate as a different user or assume unintended roles, gaining access to backend services and data they should not reach. In multi-tenant or microservice architectures, this could lead to cross-tenant data exposure or service compromise. The authorization bypass means existing credential controls become unreliable, undermining zero-trust and defense-in-depth strategies.

Affected systems

Apache APISIX versions 2.14.1, 2.15.x, 3.0.x through 3.16.0 are affected. This includes all minor and patch releases within that span. Organizations should verify their exact APISIX version and check whether the authz-casdoor plugin is enabled in their deployment. The vulnerability only manifests when the plugin is active; environments not using this specific authentication plugin are not at risk.

Exploitability

Exploitation requires an attacker to already possess valid credentials and network access to an APISIX instance. The attack is straightforward once access is obtained—no special tools, complex techniques, or zero-day knowledge is needed. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) reflects that an authenticated, unprivileged user can conduct the attack over the network with low complexity. The lack of KEV designation suggests no active in-the-wild exploitation has been reported at publication, though this does not rule out future weaponization.

Remediation

Immediate remediation is to upgrade to Apache APISIX version 3.17.0 or later. Organizations unable to upgrade immediately should disable the authz-casdoor plugin until patching is feasible, or restrict network access to APISIX instances to trusted users only. Review any access logs or authentication events for suspicious credential reuse patterns or cross-source authentication attempts that might indicate exploitation. Validate that plugin configuration is not relying on default settings in production—strengthen credential policies and implement additional authorization checks at the application layer.

Patch guidance

Upgrade to Apache APISIX version 3.17.0, which contains the authorization fix. For organizations on older major versions (e.g., 2.14.x, 3.0.x), verify the vendor advisory at apache.org for long-term support (LTS) guidance and available update paths. Test the upgrade in a staging environment first to ensure compatibility with your authentication backends and existing policies. After upgrade, verify that the authz-casdoor plugin is functioning correctly and that cross-source credential misuse is no longer possible.

Detection guidance

Monitor APISIX authentication logs for anomalies such as: (1) a single user account authenticating multiple times from different credential sources or identity providers; (2) authentication events where the claimed source identity does not match the underlying credential provider; (3) successful authentication immediately after a failed attempt with different source parameters. Implement alerting on repeated failed authentication followed by success, or on any sign of credential source mismatch. Network-level monitoring can flag unusual API patterns following authentication. Review plugin configuration files to ensure authz-casdoor is not running with default settings and that credential source validation is explicitly enforced.

Why prioritize this

This vulnerability rates HIGH (CVSS 8.1) due to its combination of confidentiality and integrity impact on authenticated systems. An insider or low-privileged attacker can bypass authorization controls to access sensitive backend data and services. While it requires prior authentication, the ease of exploitation and the breadth of affected versions (2.14.1–3.16.0) make it a priority for patching, especially in multi-tenant or high-value environments. Organizations using APISIX as a gateway to critical microservices should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects a HIGH-severity vulnerability. The attack vector is network-based (AV:N) with low complexity (AC:L), making it easy to exploit remotely. A low-privileged, authenticated user can execute the attack without user interaction (PR:L, UI:N). The scope is unchanged (S:U), but the vulnerability achieves both high confidentiality (C:H) and high integrity (I:H) impact—an attacker can read and modify data or settings via the compromised authorization. Availability is not impacted (A:N). The score reflects realistic operational risk in production gateway scenarios where APISIX sits between clients and sensitive backend services.

Frequently asked questions