Authorization Bypass in GoAdmin Reveals Vulnerabilities for Users

CVE-2026-92793

What is CVE-2026-92793?

The GoAdmin application prior to version 1.2.26 is susceptible to an authorization bypass vulnerability. This issue arises from the failing to properly anchor the logout pattern during permission checks. Authenticated users can exploit this flaw by appending a specific query parameter to access administrative endpoints illicitly. As a result, attackers may conduct unauthorized actions, which include reading sensitive data and altering the application's state. This vulnerability underscores the importance of strict permission checks to safeguard sensitive functionalities.

References