GHSA-xfx2-prg5-jq3g: Github.com/romitou/insatutorat INSATutorat Has An Authorization Bypass Vulnerability
HIGHGHSA-xfx2-prg5-jq3g is a HIGH insatutorat has an authorization bypass vulnerability (CWE-285: Improper Authorization) affecting Github.com/romitou/insatutorat libraries in the Go ecosystem. The issue involves insatutorat has an authorization bypass vulnerability in its /api/admin/* endpoints. Remediation is available by upgrading affected packages to version 0.0.0-20260226075457-15ae47425aed.
GHSA-xfx2-prg5-jq3g at a Glance
How to Fix GHSA-xfx2-prg5-jq3g
To remediate this vulnerability, upgrade all affected Github.com/romitou/insatutorat dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/romitou/insatutorat to 0.0.0-20260226075457-15ae47425aedRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/romitou/insatutoratHow to Check if You Are Affected
To determine whether your application is affected by GHSA-xfx2-prg5-jq3g, inspect your project dependencies for Github.com/romitou/insatutorat:
inspect dependencies for github.com/romitou/insatutoratAnalyze the terminal output to locate any version of Github.com/romitou/insatutorat in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260226075457-15ae47425aed), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Github.com/romitou/insatutorat, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-xfx2-prg5-jq3g Affected Github.com/romitou/insatutorat Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/romitou/insatutorat
|
Go |
< 0.0.0-20260226075457-15ae47425aed
|
0.0.0-20260226075457-15ae47425aed
|
References
Frequently Asked Questions
What is GHSA-xfx2-prg5-jq3g?
Which Github.com/romitou/insatutorat versions are affected?
What version fixes GHSA-xfx2-prg5-jq3g?
Is github.com/romitou/insatutorat affected?
What CWE is associated with GHSA-xfx2-prg5-jq3g?
How can I check Go dependencies for GHSA-xfx2-prg5-jq3g?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xfx2-prg5-jq3g",
"modified" : "2026-03-01T01:22:25Z",
"published" : "2026-03-01T01:22:25Z",
"aliases" : [ ],
"summary" : "INSATutorat has an authorization bypass vulnerability in its /api/admin/* endpoints",
"details" : "### Impact\n\nAn authorization bypass vulnerability was discovered in the administration pages of the tutoring application. When a standard user (logged in but without administrator privileges) attempts to access a resource under /api/admin/, the system detects the error but does not block the request.\n\nAs a result, sensitive data is still transmitted by the server in the request (GET), and modification actions such as campaign creation (POST) are executed successfully despite the FORBIDDEN error message. All /api/admin/* endpoints are affected.\n\n### Remediation\n\nThe issue was resolved by adding the missing c.Abort() instruction in the Gin authentication middleware (commit 15ae474). This instruction immediately interrupts the processing chain if the user is not an administrator.\n\n### Workarounds\n\nThere is no workaround other than applying the fix in the source code.\n\n### Resources:\n* Link to the fix commit: [15ae474](https://github.com/Romitou/INSATutorat/commit/15ae47425aed337181f7a6c54a9d199c93b041eb)\n\n\n### Credits\nINSATutorat thanks the Master 2 SSI 25-26 team at the University of Rouen Normandie for their research work on this project.\n- Malak Bekkai\n- Matthieu Espada Mora\n- Amen Allah Khalf Allah\n- Liam Laouenan\n- Neila Ould Slimane\n- Lucas Thomire\n\nThis advisory was translated from French to English by GitHub Copilot.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/romitou/insatutorat"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.0-20260226075457-15ae47425aed"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/Romitou/INSATutorat/security/advisories/GHSA-xfx2-prg5-jq3g"
}, {
"type" : "WEB",
"url" : "https://github.com/Romitou/INSATutorat/commit/15ae47425aed337181f7a6c54a9d199c93b041eb"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/Romitou/INSATutorat"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-285" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-01T01:22:25Z",
"nvd_published_at" : null
}
}