CVE-2026-108740

GoatCounter versions through 2.7.0 are vulnerable to a mass assignment privilege escalation flaw in the userPrefSave handler. This vulnerability allows authenticated users to modify protected account fields via form-encoded requests to the /user/pref endpoint. Specifically, an attacker with read-...