See how goatcounter compares to other vendors in security performance
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]= and user.emailverified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.