CVE-2026-92793

high

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appen…

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

CVSS

8.1

8.1 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)

Timeline (UTC)

Published: 2026-09-16 21:17

Modified: 2026-09-22 20:53

NVD status: Deferred

Last synced 2 days ago

Verified against the source API 2026-10-27 06:54 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

Not reported by the source (unknown — not "none").

Weakness classification (CWE)

CWE-863

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

No vendor advisory or patch reference tagged by NVD. Check the references below.

References

https://github.com/GoAdminGroup/go-admin disclosure@vulncheck.com
https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/modules/auth/middleware.go#L177 disclosure@vulncheck.com
https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/plugins/admin/models/user.go#L129-L1... disclosure@vulncheck.com
https://github.com/GoAdminGroup/go-admin/issues/690 disclosure@vulncheck.com
https://www.vulncheck.com/advisories/goadmin-through-1.2.26-authorization-bypass-via-query... disclosure@vulncheck.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 06:54 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores