EUVD-2026-81056
GHSA-p5vv-57h4-97rx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege GoAdmin user
-
DeliveryCraft admin endpoint request with appended ?...<prefix>/logout query
-
ExploitUnanchored pattern match bypasses permission middleware
-
ExecutionReach administrative endpoint
-
ImpactRead sensitive data and modify application state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated GoAdmin session at low privilege (PR:L) - the attacker must already have an account on the target instance. Exploitation then needs no user interaction and no special server configuration: the flaw is in the default permission-checking middleware for any GoAdmin deployment up to and including 1.2.26. The technique is to append a query string containing the configured admin prefix followed by /logout to the target admin URL, exploiting the unanchored logout-pattern match. Limiting factors: authentication is mandatory (not remotely anonymous), and impact scope is bounded by the admin endpoints reachable within the single application (S:U / SC:N, no cross-system scope change). |
| Impact | This is a genuine, actionable authorization flaw (CWE-863) rather than an inflated high-CVSS issue. The vendor CVSS 4.0 base score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) reflects a network-reachable, low-complexity bypass yielding high confidentiality and integrity impact with no user interaction. The one real limiter is PR:L: the attacker must already hold a valid, low-privilege authenticated GoAdmin session, so this is a privilege-escalation/horizontal-access flaw for insiders or holders of a compromised low-tier account, not an anonymous internet takeover. Exploitation signals are modest: no CISA KEV entry, no EPSS score provided, and no public exploit code identified - though the linked GitHub issue #690 and VulnCheck advisory describe the mechanism in enough detail that weaponization is trivial (append a crafted query string). Note the tag 'Authentication Bypass' is imprecise: the CVSS PR:L and CWE-863 make this an AUTHORIZATION (permission) bypass by an already-authenticated user, not an authentication bypass. Net: prioritize patching for any internet- or multi-tenant-exposed GoAdmin instance where low-privilege accounts exist, but the authentication gate keeps this below the tier of a fully unauthenticated RCE. |
| Exploit ScenarioDerived | An attacker holding a low-privilege authenticated GoAdmin account crafts a request to an admin-only endpoint but appends a query string containing the admin prefix followed by /logout, so the unanchored logout pattern match causes the permission middleware to treat the request as the exempt logout route. The request slips past the authorization check and reaches administrative functionality, letting the attacker read sensitive data and modify application state. No public exploit code is identified, but the GitHub issue and VulnCheck advisory document the technique precisely. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Authorization bypass in GoAdmin through 1.2.26 allows any authenticated user with a valid session (CVSS PR:L - an account on the target instance is required) to reach administrative endpoints by appending a crafted query string containing the configured admin prefix followed by /logout to a request URL; the permission-checking middleware mistakes the request for the exempt logout route and skips authorization entirely. Successful exploitation permits unauthorized reads of sensitive data and modification of application state (C:H/I:H), with no user interaction needed in a default deployment. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis - the issue is tracked as EUVD-2026-81056 and reported by VulnCheck, and no vendor-released patch version is identified in the available data.
RemediationAI
No vendor-released patch version is identified in the available data, so remediation currently depends on either upgrading to a release newer than 1.2.26 once the maintainers publish a fix (track https://github.com/GoAdminGroup/go-admin/issues/690 and the project repository https://github.com/GoAdminGroup/go-admin, and verify the middleware anchors its logout/prefix match before deploying) or applying compensating controls. Practical mitigations: front the admin interface with a reverse proxy or WAF rule that rejects any request whose query string contains the string '/logout' (or the configured admin prefix immediately followed by '/logout') while allowing the legitimate logout endpoint - the trade-off is that any application feature legitimately passing '/logout' as a query value would be broken and must be allow-listed; restrict the admin prefix to an unguessable value and bind the admin interface to an internal network or VPN-only source range, which reduces reachable attack surface but does not fix the logic flaw; and enforce least privilege by removing or downgrading accounts that do not need administrative access, since exploitation requires a valid authenticated session (PR:L) - this limits but does not eliminate exposure for accounts that legitimately hold elevated permissions. Log and alert on admin requests carrying unusual query strings and review role/user definitions in the GoAdmin user model for signs of unauthorized privilege use. Note that these are compensating measures only; no configuration change in the provided data is confirmed to close the underlying CWE-863 defect.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GoAdmin is a Go-based admin panel framework whose authorization logic lives in the auth middleware (modules/auth/middleware.go, around line 177), which maintains an exempt-route list so that paths such as logout are reachable without a permission check. The logout pattern is matched without anchoring (a substring/regex match lacking start/end boundaries), so any request whose URL - including the query string - contains the admin prefix followed by '/logout' satisfies the exemption check and bypasses the normal permission verification performed against the role definitions stored via the user model (plugins/admin/models/user.go, lines 129-133). This is CWE-863 (Incorrect Authorization): the root cause is not a missing check but an over-broad route matcher, an input-handling defect in the authorization decision rather than in authentication. Because the bypass runs inside the same application and the same session privilege domain, the assessed scope is unchanged (S:U), and the affected code path exists in every GoAdmin deployment up to and including 1.2.26 - fixing it requires anchoring the logout/prefix match in the middleware rather than altering permissions data.
Know when Go Admin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Network-reachable low-complexity bypass requiring a valid low-privilege account (PR:L), no UI; grants admin data read and state modification (C:H/I:H) with no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Executive ViewAI
GoAdmin deployments through version 1.2.26 are affected by an authorization bypass that allows any authenticated user to reach administrative functions, exposing sensitive data and permitting unauthorized changes to application state. Leadership should treat this as a high-priority access-control failure because low-privilege accounts can effectively obtain administrative capabilities without user interaction. No public exploit identified at time of analysis; organizations running GoAdmin should inventory affected instances and prepare to apply a vendor fix once released.
No vendor-released patch identified at time of analysis; interim mitigations include restricting admin interface access to trusted networks/VPN, enforcing least privilege, blocking or alerting on query strings containing the admin prefix followed by /logout at WAF/reverse proxy, and reviewing logs for anomalous admin endpoint access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key. Rated critical severity (CVSS 9.8), thi
SQL injection vulnerability in Go-CMS v.1.1.10 allows a remote attacker to execute arbitrary code via a crafted payload.
Exploit-DB