Description
GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GoAdminGroup | go-admin | ≤ 1.2.26 | — |
References
- GitHub Issue #690 issue-tracking
- https://github.com/GoAdminGroup/go-admin product
- the unanchored logout pattern short-circuits the permission check technical-description
- Filter passes the full URL including the query string technical-description
- VulnCheck Advisory: GoAdmin through 1.2.26 Authorization Bypass via Query Parameter third-party-advisory