CVE-2026-92793 — GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query param…
Published: 2026-09-16 · CVSS: 8.6 · CVSS 4.0
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7