CVE-2026-92793: Goadmingroup Go-Admin

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permission checks by appending a query parameter. Attackers can append a query string containing the admin prefix followed by /logout to reach administrative endpoints and perform unauthorized actions including reading sensitive data and modifying application state.

Affected products

• Goadmingroup Go-Admin: up to and including 1.2.26

Published 2026-09-16. Last modified 2026-09-22.