TI-2026-70719 CVE-2026-108740 · GHSA-4f43-5hgr-4m7r
Privilege escalation in GoatCounter via /user/pref mass assignment
Priority LOW 34
GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests.