CVE-2026-108740: GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

Q: Who can exploit this issue?

An attacker must be logged in with read-only access. The described exploit does not require user interaction and can be sent over the network as a form-encoded request.

Q: What access can an attacker obtain?

A read-only user can submit protected account fields to the /user/pref endpoint, including user.access[all]=* and user.email_verified=true. This can elevate the account to superuser or administrator access.

Q: How can I check whether an account may have been compromised?

Review requests to /user/pref from logged-in accounts for form parameters such as user.access[all]=* or user.email_verified=true. Also review user accounts for unexpected superuser or administrator privileges and changed email-verification status.

Q: What can be done if patching is not immediately possible?

Restrict or disable access to the /user/pref endpoint for untrusted or read-only users, and ensure read-only accounts cannot submit account-preference update requests. Audit existing privileged accounts and revoke unexpected elevated access.

Published Oct 11, 2026

Updated

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]= and user.emailverified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.

Affected Software

1 affected component

GoatCounter GoatCounter<=2.7.0

Event History

Oct 11, 2026

CVE Published

via MITRE·12:19 PM

Data Sourced

via MITRE·12:19 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be logged in with read-only access. The described exploit does not require user interaction and can be sent over the network as a form-encoded request.

What access can an attacker obtain?

A read-only user can submit protected account fields to the /user/pref endpoint, including user.access[all]=* and user.email_verified=true. This can elevate the account to superuser or administrator access.

How can I check whether an account may have been compromised?

Review requests to /user/pref from logged-in accounts for form parameters such as user.access[all]=* or user.email_verified=true. Also review user accounts for unexpected superuser or administrator privileges and changed email-verification status.

What can be done if patching is not immediately possible?

Restrict or disable access to the /user/pref endpoint for untrusted or read-only users, and ensure read-only accounts cannot submit account-preference update requests. Audit existing privileged accounts and revoke unexpected elevated access.

CVE-2026-108740: GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker obtain?

How can I check whether an account may have been compromised?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access can an attacker obtain?

How can I check whether an account may have been compromised?

What can be done if patching is not immediately possible?