https://vulnerability.circl.lu/sightings/feed 2026-10-11T23:32:33.733501+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/bcf834e1-5fd4-4c74-8ee1-094f2532e3e9/export 2026-10-11T23:32:33.810808+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "bcf834e1-5fd4-4c74-8ee1-094f2532e3e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/jbq624gokhrgz", "content": "CVE-2026-108740 - GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment\nCVE ID : CVE-2026-108740\n \n Published : Oct. 11, 2026, 1:17 p.m. | 13\u00a0minutes ago\n \n Description : GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerab...", "creation_timestamp": "2026-10-11T14:08:10.379624Z"} 2026-10-11T14:08:10.379624+00:00 https://vulnerability.circl.lu/sighting/a5785a28-dbce-4325-a883-b64cf71c8303/export 2026-10-11T23:32:33.812579+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "a5785a28-dbce-4325-a883-b64cf71c8303", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108740", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422387792660278", "content": "CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108740https://hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218https://github.com/arp242/goatcounterhttps://www.vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignment#arp242 #GoatCounter#CVE_2026_108740#bot", "creation_timestamp": "2026-10-11T12:57:27.219613Z"} 2026-10-11T12:57:27.219613+00:00