Gophish
CVE-2025-70963
HIGH
GHSA-9f8m-9547-2gqm
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 7.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: Required. Exploitation requires authentication. Public exploit/POC available. |
| Exploit ScenarioDerived | An attacker (requires authentication) could exploit this vulnerability to compromise the affected system. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. [CVSS 7.6 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-200 (Information Exposure). Affects Gophish. Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Know when Gophish gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Executive ViewAI
Gophish administrative dashboards running version 0.12.1 or earlier expose sensitive API credentials in plaintext within browser memory and page source, allowing attackers with access to administrator workstations or network traffic to compromise phishing infrastructure management capabilities. This vulnerability poses a direct threat to organizations using Gophish for authorized security testing, as credential compromise could enable unauthorized access to campaign data, templates, and victim information.
Implement WAF rules to restrict administrative dashboard access by IP whitelist only; enforce TLS 1.3 with certificate pinning for all Gophish administrative connections; disable API key functionality where possible and use temporary, short-lived tokens instead; deploy endpoint detection and response (EDR) on administrator workstations to monitor for credential harvesting; implement network segmentation to isolate Gophish infrastructure from production systems; rotate API keys on a weekly schedule until patch availability; monitor for suspicious API authentication patterns and failed login attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8),
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerab
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phis
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.1
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrato
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated m
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated med
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the ser
Same weakness CWE-200 – Information Exposure
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Exploit-DB