GoAdmin through 1.2.26 Authorization Bypass via Query Parameter

Advisories

GoAdmin through 1.2.26 Authorization Bypass via Query Parameter

severity: high
date: 9/16/2026
Affecting: go-admin <= 1.2.26
CVE: CVE-2026-92793
CWE: CWE-863 Incorrect Authorization
CVSS: 8.6
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: GitHub Issue #690
https://github.com/GoAdminGroup/go-admin
the unanchored logout pattern short-circuits the permission check
Filter passes the full URL including the query string
Credit: George Chen
Description: GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo