Hello team, the 8th of July I have submitted a security vulnerability to admin@casdoor.org and I have never received a response about it.
It is still exploitable, but given more than 90 days passed, we are allowed to go on full disclosure publicly.
Please reply to the email if you still want to work together on a fix for the community.
Thanks

