GHSA-9f8m-9547-2gqm

ghsaUSosv

Gophish is vulnerable to Incorrect Access Control

view advisory published 2026-02-06Licence: CC-BY-4.0

Gophish <= 0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-70963US	—	0.31% (24th)	—	2026-02-06
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the…

references

External citations — patches, advisories, analysis.

https://github.com/gophish/gophishPACKAGE
https://github.com/gophish/gophish/issues/9366WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-70963ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan