Vendor
GoatCounter versions 2.7.0 and earlier are vulnerable to a mass assignment flaw in the userPrefSave handler, enabling authenticated users to escalate privileges to administrator status.