GoAdmin versions up to 1.2.26 fail to properly anchor the logout pattern during permission checks. This improper authorization allows authenticated users to bypass intended access controls by appending a query string containing the admin prefix followed by /logout. Exploiting this, attackers can reach administrative endpoints without proper permissions, enabling unauthorized actions such as reading sensitive data and modifying application state. The vulnerability has a CVSS 4.0 base score of 8.6, indicating high severity.

Authenticated users can bypass permission checks and access administrative endpoints, leading to unauthorized reading of sensitive data and modification of application state. This could compromise the confidentiality and integrity of the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to authenticated users and monitor for suspicious query parameters that exploit this bypass.