N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xfx2-prg5-jq3g

GHSA-xfx2-prg5-jq3g: INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints

Impact

An authorization bypass vulnerability was discovered in the administration pages of the tutoring application. When a standard user (logged in but without administrator privileges) attempts to access a resource under /api/admin/, the system detects the error but does not block the request.

As a result, sensitive data is still transmitted by the server in the request (GET), and modification actions such as campaign creation (POST) are executed successfully despite the FORBIDDEN error message. All /api/admin/* endpoints are affected.

Remediation

The issue was resolved by adding the missing c.Abort() instruction in the Gin authentication middleware (commit 15ae474). This instruction immediately interrupts the processing chain if the user is not an administrator.

Workarounds

There is no workaround other than applying the fix in the source code.

Resources:

Link to the fix commit: 15ae474

Credits

INSATutorat thanks the Master 2 SSI 25-26 team at the University of Rouen Normandie for their research work on this project.

Malak Bekkai
Matthieu Espada Mora
Amen Allah Khalf Allah
Liam Laouenan
Neila Ould Slimane
Lucas Thomire

This advisory was translated from French to English by GitHub Copilot.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-xfx2-prg5-jq3g

GHSA-xfx2-prg5-jq3g:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/romitou/insatutorat	go	< 0.0.0-20260226075457-15ae47425aed	0.0.0-20260226075457-15ae47425aed

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an authorization bypass in the AdminHandler middleware. The function is designed to protect routes under /api/admin/ by verifying that the user has administrator privileges. Before the fix, if a non-admin user attempted to access a protected route, the AdminHandler would correctly identify the lack of permissions and set an error status on the request context. However, it failed to halt the request processing chain. As a result, the request would proceed to the intended route handler despite the authorization failure, allowing the unauthorized user to access or modify sensitive data. The patch, identified in commit 15ae474, resolves this issue by adding a c.Abort() call after setting the error. This ensures that the request is immediately terminated, preventing it from reaching the protected route handler. The vulnerable function is therefore middlewares.AdminHandler as it contained the flawed authorization logic.

Vulnerable functions

middlewares.AdminHandler

middlewares/admin.go

This middleware function is responsible for checking if a user is an administrator before allowing access to admin-only routes. The vulnerability existed because the function would set an error if the user was not an admin but would not stop the request from continuing to the protected route. The patch added `c.Abort()` to terminate the request immediately after an authorization failure is detected.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-xfx2-prg5-jq3g: INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints

Impact

Remediation

Workarounds

Resources:

Credits

GHSA-xfx2-prg5-jq3g:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

N/A

N/A

GHSA-xfx2-prg5-jq3g: INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints

Impact

Remediation

Workarounds

Resources:

Credits

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI