rootpwn

high · CVSS v3 8.1 · CVSS v4 8.6

CVE-2026-92793

GoAdmin 1.2.26 contains a permission‑check flaw that lets authenticated users bypass admin restrictions by appending a crafted query string

Overview

GoAdmin 1.2.26 contains a permission‑check flaw that lets authenticated users bypass admin restrictions by appending a crafted query string to the logout URL. This allows attackers to access sensitive data and alter application state without proper authorization.

Description

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

Impact

Confidentiality: Unauthorized read of sensitive data. Integrity: Unauthorized modification of application state. Availability: No direct impact, but potential for cascading changes that could disrupt services.

Remediation

['Upgrade to GoAdmin 1.2.27 or later where the logout pattern is correctly anchored.', 'If an upgrade is not immediately possible, block or sanitize query parameters that contain the admin prefix or enforce strict path validation.', 'Implement or verify CSRF protection on admin endpoints.', 'Review and tighten role‑based access controls to ensure only privileged users can reach administrative URLs.']

Risk context

High severity (CVSS v3 8.1 / v4 8.6). No EPSS data available. The vulnerability enables privilege escalation for any authenticated user, making it a high‑priority issue for organizations running GoAdmin 1.2.26.

Affected products

  • GoAdmin 1.2.26
  • GoAdmin

Scores

Severity
high
CVSS v2
8.5
CVSS v3
8.1
CVSS v4
8.6
EPSS
—

GoAdmin Permission Bypass Authentication Bypass Privilege Escalation High Severity Query Parameter Admin Endpoint

← All CVEs

Related CVEs

high

CVE-2026-81546

Affinity by Canva versions prior to 3.3.0 are vulnerable to a stack-based buffer overflow when parsing Affinity document files. An attacker can craft a malicious file that, when opened, may allow arbitrary code execution on the victim’s machine.

View analysis

high

CVE-2026-92838

A DLL hijacking flaw in GeoVision GV-Remote E-Map allows a local user with write access to a directory to drop a malicious DLL that is loaded before the legitimate one. If exploited, the attacker can run arbitrary code in the context of the GV-Remote E-Map process, potentially compromising local data and system integrity.

View analysis

high

CVE-2026-88765

A high‑severity buffer overflow in the Unicode conversion wrapper of certain Git hosting platforms allows an authenticated user to upload a crafted Git export file that triggers arbitrary remote code execution during Advanced Search indexing. The flaw can lead to full server compromise if exploited.

View analysis

high

CVE-2026-92380

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file coreframe/app/attachment/index.php of the component Remote Image Fetch. This manipulation of the argument source[] causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

View analysis