Executive brief
GoAdmin is a Go framework for rapidly building admin panels and data visualization dashboards. A flaw in its permission-checking middleware allows authenticated users to bypass access controls by appending a specially crafted query parameter, gaining unauthorized access to administrative functions including reading sensitive data and modifying application settings.
Technical details
The vulnerability exists in GoAdmin's authentication middleware (modules/auth/middleware.go) where the logout pattern used for permission checking is not properly anchored, likely missing regex anchors or string terminators. An authenticated attacker can append a query parameter containing the admin prefix followed by /logout to bypass permission validation checks. This allows an authenticated user to access administrative endpoints they should not have permission to use, potentially reading sensitive configuration or data and modifying application state. The flaw requires authentication but no elevated privileges; fix/patch status beyond v1.2.26 should be verified.
Affected products
- GoAdminGroup go-admin through 1.2.26
Timeline
- 2026-09-16: disclosed