Casdoor, an open-source access management platform, has an authorization bypass vulnerability. This flaw affects versions 3.115.0 and earlier. It allows non-global organization administrators to execute unauthorized administrative actions on other organizations. The vulnerability arises from a desynchronization between Casdoor's authorization checks and its action execution. Specifically, the authorization layer uses a URL parameter for decisions, while controllers rely on request body fields. This discrepancy means authorization is checked against one object, but an operation is performed on another. In multi-tenant setups, an administrator within one organization can bypass tenant isolation. Exploitation can lead to unauthorized user management, privilege manipulation, and disruption of SSO or SAML identities. This can escalate to a full compromise of tenant isolation or even the entire Casdoor instance. Unfortunately, no vendor patch is currently available. Mitigation strategies include enforcing least privilege, requiring MFA for administrators, and alerting on cross-organization administrative activity.