CVE-2026-108740 GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment
Logged-in users can escalate privileges to superuser by modifying protected fields via mass assignment in the user preference handler.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108740?
CVE-2026-108740 is a high-severity vulnerability in arp242 GoatCounter, published on 11 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access.
Weakness: CWE-915
Which versions are affected by CVE-2026-108740?
How do I fix CVE-2026-108740?
No fix has been published for CVE-2026-108740 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-108740 being exploited?
There is no known exploitation of CVE-2026-108740 in the wild and no public exploit code.
Sources
Also known as GHSA-4f43-5hgr-4m7r.