Vulnerability Description
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/GoAdminGroup/go-admin
- https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/modules/auth/middleware.go
- https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/plugins/admin/models/user.
- https://github.com/GoAdminGroup/go-admin/issues/690
- https://www.vulncheck.com/advisories/goadmin-through-1.2.26-authorization-bypass
FAQ
What is CVE-2026-92793?
CVE-2026-92793 is a vulnerability with a CVSS score of 8.1 (HIGH). GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can app...
How severe is CVE-2026-92793?
CVE-2026-92793 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92793?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.