GoatCounter versions through 2.7.0 include a mass assignment flaw in the userPrefSave handler. The bug allows a logged‑in user to submit form‑encoded requests that modify protected fields such as user.access[all] and user.email_verified. Because the handler bypasses readonly tags, an attacker with read‑only access can elevate to a superuser or administrator, making this an authenticated privilege escalation issue classified as CWE‑915.

The vulnerability affects the GoatCounter web analytics platform developed by arp242. Any deployment of GoatCounter 2.7.0 or earlier is vulnerable. The issue is specific to the /user/pref endpoint that handles user preference updates.

The CVSS score of 7.2 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector is an authenticated user, since the exploit requires a locally authenticated POST request to /user/pref. Once exploited, the attacker gains full administrative control over the GoatCounter instance.