CVE-2026-92793

Name of the Vulnerable Software and Affected Versions GoAdmin versions prior to 1.2.27

Description Authenticated users can bypass permission checks by appending a query parameter to the request. This occurs because the software fails to properly anchor the logout pattern during permission verification. By adding a query string that includes the admin prefix followed by /logout, an attacker can access administrative endpoints to perform unauthorized actions, such as reading sensitive data and modifying the application state.

Recommendations Update GoAdmin to version 1.2.27 or later.