EUVD-2026-94401
GHSA-5h35-6pm3-mw32
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated low-priv user over the network with no UI (PR:L, AV:N, AC:L, UI:N); overwrite/reassignment drives I:H, recipient-list exposure gives C:L, and A:N since lockout is a consequence of integrity loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
AnalysisAI
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over other users' groups, templates, landing pages, and sending profiles by supplying a victim's sequential object ID to the API create endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/). Because the server trusts the client-supplied ID instead of assigning a new one, the attacker can overwrite and reassign the victim's objects, locking the original owner out and exposing their recipient lists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to hold a valid authenticated account (any low-privileged user) on a Gophish instance running version 0.12.1 or earlier, and the deployment must be multi-user so that other users' groups, templates, landing pages, or sending profiles exist to hijack - a single-operator install has no victims. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but context-gated issue rather than an internet-wide emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified at time of analysis; the references point to the vulnerable source in the Gophish repository (commit b1648f0) rather than to a fixed release, so upgrading should be tracked against the upstream project at https://github.com/gophish/gophish and the VulnCheck advisory at https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints before assuming any version resolves it. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Gophish installations to confirm which run version 0.12.1 or earlier and identify every multi-user deployment, since single-operator installs present no hijackable objects; for each multi-user deployment, reduce the account roster to the minimum trusted administrators, revoke or disable dormant and shared accounts, and restrict network access to the Gophish web console and API to a hardened management network or VPN with allow-listed source addresses. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8),
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerab
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phis
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.1
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrato
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated m
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated med
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the ser
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today