Skip to content
OpenAdvisories

Vendor

gophish

8 known vulnerabilities.

Products

gophish 7 Admin Panel 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-107270

    Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

    Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST reques…

    gophish gophish
  • High 8.1
    CVE-2026-82269

    Gophish Account Lockout and Forced Password Change Bypassable via API Key

    Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or pas…

    gophish gophish