CyberRota Analysis
AI-GeneratedGoAdmin versions up to 1.2.26 have a vulnerability that allows authenticated users to bypass permission checks by manipulating the logout URL with a specific query parameter. This flaw enables attackers to access administrative endpoints, potentially leading to unauthorized actions such as reading sensitive data and altering application state. Organizations using GoAdmin should prioritize patching this vulnerability to mitigate the risk of unauthorized access and data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.