{"schema":"threatline.record/2","record":{"id":"CVE-2026-108740","aliases":[],"summary":"GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment","details":"GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.","categories":["Unclassified"],"product":"GoatCounter","vendor":"arp242","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-108740","source_modified_at":"2026-10-13T13:28:05.697Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"GoatCounter","vendor":"arp242","versions":[{"version":"0","lessThanOrEqual":"2.7.0","status":"affected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":7.2,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00328,"percentile":0.24731,"score_date":"2026-10-23"},"published_at":"2026-10-11T12:19:44.911Z","modified_at":"2026-10-13T13:28:05.697Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-108740","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-13T13:28:05.697Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-108740","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/arp242/goatcounter","tags":["product"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignment","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-13T13:25:32.903321Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-13T13:28:05.697Z","content_hash":"53ad87e58a1459b8e13a1e76be469413a37d1c114f47ee4b0b94ff62b73f8c3c"}}