CVE-2026-92793: GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GoAdminto a version that resolves this vulnerability.Fixed in 1.2.26
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must already be authenticated to the GoAdmin application. No user interaction is required, and the attack can be performed remotely over the network.
What request manipulation is required to bypass authorization?
The attacker appends a query string containing the admin prefix followed by /logout when requesting an administrative endpoint. This can cause the permission check to treat the request as matching the logout pattern and allow unauthorized actions.
What is the potential impact of successful exploitation?
An authenticated user may reach administrative endpoints beyond their assigned permissions. The reported impacts include reading sensitive data and modifying application state.
Which versions are affected?
GoAdmin through version 1.2.26 is affected.