Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities by GoAdminGroup
CVE-2026-92793 (GCVE-0-2026-92793)
Vulnerability from nvd – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
VLAI
EPSS
VEX
Title
GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
Summary
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/GoAdminGroup/go-admin/issues/690 | issue-tracking |
| https://github.com/GoAdminGroup/go-admin | product |
| https://github.com/GoAdminGroup/go-admin/blob/v1.… | technical-description |
| https://github.com/GoAdminGroup/go-admin/blob/v1.… | technical-description |
| https://www.vulncheck.com/advisories/goadmin-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GoAdminGroup | go-admin |
Affected:
0 , ≤ 1.2.26
(semver)
cpe:2.3:a:go-admin:go-admin:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/GoAdminGroup/go-admin",
"product": "go-admin",
"vendor": "GoAdminGroup",
"versions": [
{
"lessThanOrEqual": "1.2.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:go-admin:go-admin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.2.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:48.293Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #690",
"tags": [
"issue-tracking"
],
"url": "https://github.com/GoAdminGroup/go-admin/issues/690"
},
{
"tags": [
"product"
],
"url": "https://github.com/GoAdminGroup/go-admin"
},
{
"name": "the unanchored logout pattern short-circuits the permission check",
"tags": [
"technical-description"
],
"url": "https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/plugins/admin/models/user.go#L129-L133"
},
{
"name": "Filter passes the full URL including the query string",
"tags": [
"technical-description"
],
"url": "https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/modules/auth/middleware.go#L177"
},
{
"name": "VulnCheck Advisory: GoAdmin through 1.2.26 Authorization Bypass via Query Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/goadmin-through-1.2.26-authorization-bypass-via-query-parameter"
}
],
"title": "GoAdmin through 1.2.26 Authorization Bypass via Query Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92793",
"datePublished": "2026-09-16T20:32:48.293Z",
"dateReserved": "2026-09-16T19:40:20.184Z",
"dateUpdated": "2026-09-16T20:32:48.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92793 (GCVE-0-2026-92793)
Vulnerability from cvelistv5 – Published: 2026-09-16 20:32 – Updated: 2026-09-16 20:32
VLAI
EPSS
VEX
Title
GoAdmin through 1.2.26 Authorization Bypass via Query Parameter
Summary
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Severity
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/GoAdminGroup/go-admin/issues/690 | issue-tracking |
| https://github.com/GoAdminGroup/go-admin | product |
| https://github.com/GoAdminGroup/go-admin/blob/v1.… | technical-description |
| https://github.com/GoAdminGroup/go-admin/blob/v1.… | technical-description |
| https://www.vulncheck.com/advisories/goadmin-thro… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| GoAdminGroup | go-admin |
Affected:
0 , ≤ 1.2.26
(semver)
cpe:2.3:a:go-admin:go-admin:*:*:*:*:*:*:*:* |
Date Public
2026-09-14 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/GoAdminGroup/go-admin",
"product": "go-admin",
"vendor": "GoAdminGroup",
"versions": [
{
"lessThanOrEqual": "1.2.26",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:go-admin:go-admin:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.2.26",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-09-14T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T20:32:48.293Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #690",
"tags": [
"issue-tracking"
],
"url": "https://github.com/GoAdminGroup/go-admin/issues/690"
},
{
"tags": [
"product"
],
"url": "https://github.com/GoAdminGroup/go-admin"
},
{
"name": "the unanchored logout pattern short-circuits the permission check",
"tags": [
"technical-description"
],
"url": "https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/plugins/admin/models/user.go#L129-L133"
},
{
"name": "Filter passes the full URL including the query string",
"tags": [
"technical-description"
],
"url": "https://github.com/GoAdminGroup/go-admin/blob/v1.2.26/modules/auth/middleware.go#L177"
},
{
"name": "VulnCheck Advisory: GoAdmin through 1.2.26 Authorization Bypass via Query Parameter",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/goadmin-through-1.2.26-authorization-bypass-via-query-parameter"
}
],
"title": "GoAdmin through 1.2.26 Authorization Bypass via Query Parameter",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-92793",
"datePublished": "2026-09-16T20:32:48.293Z",
"dateReserved": "2026-09-16T19:40:20.184Z",
"dateUpdated": "2026-09-16T20:32:48.293Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}