CVE-2025-4210: Casdoor SCIM User Creation Endpoint scim.go HandleScim authorization in github.com/casdoor/casdoor

The vulnerability description and the commit patch clearly identify HandleScim in controllers/scim.go as the vulnerable function. The patch adds an authorization check (c.RequireAdmin()) which was previously missing, leading to an authorization bypass. The function signature includes the receiver type (*RootController) which is standard for Go methods and would likely appear in runtime profiles. The evidence from the patch directly supports this conclusion by showing the exact lines of code added to mitigate the vulnerability within this function. The confidence is high due to the direct correlation between the vulnerability report, the function name, the file path, and the nature of the code change in the patch (addition of an authorization check).