CVE-2026-108740
GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
arp242 GoatCounter
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.33%Chance of exploitation activity in the next 30 days, higher than 24% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.
Text from CVE List
Affected versions 1
- GoatCounteraffected: all versions through 2.7.0CVE List
References 5
- hackmd.io/@haind03/goatcounter-user-pref-access-mass-assignment-20261011Advisoryvia CVE List
- vulncheck.com/advisories/goatcounter-through-2.7.0-privilege-escalation-via-user-pref-mass-assignmentAdvisoryvia CVE List
- github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/handlers/settings_user.go#L33-L99Referencevia CVE List
- github.com/arp242/goatcounter/blob/7e91d8a9bdbb0dd48496e498c5680f8f3477a1b4/user.go#L191-L218Referencevia CVE List
- github.com/arp242/goatcounterReferencevia CVE List