Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108740— GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

Quick assessment

Affected
arp242 GoatCounter
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GoatCounter 2.7.0 及之前版本中存在一处质量分配权限提升漏洞，该漏洞位于 userPrefSave 处理程序中，允许已登录用户通过表单编码请求修改受保护的账户字段。具有只读访问权限的攻击者可以向 /user/pref 端点 POST 数据，设置 user.access[all]=* 和 user.email_verified=true，从而绕过只读标签限制，获取超级用户或管理员访问权限。

CVSS 8.3 · High EPSS 0.33% · P24

Affected Version Matrix 1

VendorProduct Version RangeStatus
arp242 GoatCounter ≤ 2.7.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108740

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
Source: CVE Program / CVE List V5
Vulnerability Description
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-915
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
arp242 GoatCounter 0 ~ 2.7.0 -

II. Public POCs for CVE-2026-108740

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108740

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-108740 (2)

Vendor Advisories for CVE-2026-108740 (1)

Proof of Concept for CVE-2026-108740 (1)

Vendor Pages for CVE-2026-108740 (1)

IV. Related Vulnerabilities

Same weakness: CWE-915

V. Comments for CVE-2026-108740

No comments yet

Leave a comment