Gophish
Monthly
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over other users' groups, templates, landing pages, and sending profiles by supplying a victim's sequential object ID to the API create endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/). Because the server trusts the client-supplied ID instead of assigning a new one, the attacker can overwrite and reassign the victim's objects, locking the original owner out and exposing their recipient lists. Exploitation requires a valid account on a multi-user deployment (a single-operator install has no victims to hijack), and publicly available exploit code exists; there is no confirmed in-the-wild exploitation (CISA KEV) and no vendor patch was identified at time of analysis.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phishing-campaign server by uploading a zip-bomb Office document as an email template attachment. Publicly available exploit code exists, demonstrating that any account with the User role can trigger an OOM kill of the Gophish process and disrupt ongoing campaigns. No CISA KEV listing is present, but the trivial complexity and available POC make opportunistic abuse realistic against multi-tenant or shared Gophish deployments.
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the server to fetch arbitrary internal URLs through the POST /api/import/site endpoint, because the default dialer deny list does not block loopback or RFC1918 private destinations. Attackers can read the responses of reachable internal services and enumerate internal hosts and ports from differential error messages, but the impact is confined to information disclosure with no write, code-execution, or availability effect, and authentication is mandatory (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L). Publicly available exploit code exists - documented in an Ostorlab review of Gophish 0.12.1 and tracked by VulnCheck - while the reported CVSS 4.0 score is a moderate 5.3 and no CISA KEV entry is present in the supplied intelligence, so this is confirmed as a moderate-severity issue rather than an emergency.
Stored and reflected cross-site scripting in Gophish through 0.12.1 allows an attacker who controls or intercepts the SMTP server configured in a sending profile to inject JavaScript that runs in an administrator's browser when campaign results are viewed or a test email is sent, enabling theft of the administrator's API key. Exploitation is unauthenticated from the attacker's perspective (PR:N) but requires a significant precondition: control over, or man-in-the-middle interception of, the sending profile's SMTP endpoint, plus passive interaction by a privileged administrator; the independent assessment rates this as a low-priority issue with a CVSS:3.1 score reflecting high attack complexity (AC:H), required user interaction (UI:R), and scope change (S:C) with only low confidentiality and integrity impact. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing).
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.12.1 are enabled by a login rate-limit bypass: the throttling middleware keys its counter on a client address that is rewritten from the attacker-supplied X-Forwarded-For or X-Real-IP header, so an unauthenticated remote attacker who sends a different forwarded address with every request never trips the limiter. Publicly available exploit code exists (documented in the Ostorlab review and VulnCheck advisory), and the flaw is rated CVSS 4.0 6.9 / assessed CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); it is not confirmed actively exploited, so exploitation depends on whether the /login endpoint is network-reachable and whether targeted accounts use weak, default, or guessable credentials. The issue is genuine but moderate in severity rather than a top-tier emergency, and its real-world impact is sharply reduced for instances whose admin interface is not exposed to untrusted networks.
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrator accounts from invalid ones by measuring response-time differences in the login handler, which performs a bcrypt comparison for existing users but short-circuits for unknown ones. Rated low-to-moderate priority (CVSS 4.0 6.3; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N with low confidentiality impact), the flaw yields only a list of valid usernames and does not authenticate an attacker, disclose passwords, or modify data. Publicly available exploit code exists, but there is no evidence of active exploitation and no CISA KEV listing; real-world exposure is sharply limited to deployments where the Gophish admin interface (POST /login) is reachable from an untrusted network, since the recommended deployment keeps it on an internal or VPN-only segment.
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. [CVSS 7.6 HIGH]
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gophish before 0.11.0 allows SSRF attacks. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Gophish through 0.8.0 allows XSS via a username. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Insecure direct object reference (IDOR) in Gophish through 0.12.1 lets any authenticated, low-privileged user take over other users' groups, templates, landing pages, and sending profiles by supplying a victim's sequential object ID to the API create endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/). Because the server trusts the client-supplied ID instead of assigning a new one, the attacker can overwrite and reassign the victim's objects, locking the original owner out and exposing their recipient lists. Exploitation requires a valid account on a multi-user deployment (a single-operator install has no victims to hijack), and publicly available exploit code exists; there is no confirmed in-the-wild exploitation (CISA KEV) and no vendor patch was identified at time of analysis.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion denial of service in Gophish through 0.12.1 allows authenticated low-privilege users to crash the phishing-campaign server by uploading a zip-bomb Office document as an email template attachment. Publicly available exploit code exists, demonstrating that any account with the User role can trigger an OOM kill of the Gophish process and disrupt ongoing campaigns. No CISA KEV listing is present, but the trivial complexity and available POC make opportunistic abuse realistic against multi-tenant or shared Gophish deployments.
Server-side request forgery in Gophish 0.11.0 through 0.12.1 allows authenticated, low-privileged users to force the server to fetch arbitrary internal URLs through the POST /api/import/site endpoint, because the default dialer deny list does not block loopback or RFC1918 private destinations. Attackers can read the responses of reachable internal services and enumerate internal hosts and ports from differential error messages, but the impact is confined to information disclosure with no write, code-execution, or availability effect, and authentication is mandatory (CVSS:4.0 PR:L / assessed CVSS:3.1 PR:L). Publicly available exploit code exists - documented in an Ostorlab review of Gophish 0.12.1 and tracked by VulnCheck - while the reported CVSS 4.0 score is a moderate 5.3 and no CISA KEV entry is present in the supplied intelligence, so this is confirmed as a moderate-severity issue rather than an emergency.
Stored and reflected cross-site scripting in Gophish through 0.12.1 allows an attacker who controls or intercepts the SMTP server configured in a sending profile to inject JavaScript that runs in an administrator's browser when campaign results are viewed or a test email is sent, enabling theft of the administrator's API key. Exploitation is unauthenticated from the attacker's perspective (PR:N) but requires a significant precondition: control over, or man-in-the-middle interception of, the sending profile's SMTP endpoint, plus passive interaction by a privileged administrator; the independent assessment rates this as a low-priority issue with a CVSS:3.1 score reflecting high attack complexity (AC:H), required user interaction (UI:R), and scope change (S:C) with only low confidentiality and integrity impact. Publicly available exploit code exists, but there is no indication of confirmed active exploitation (no CISA KEV listing).
Credential stuffing and unlimited password guessing against the Gophish phishing-simulation platform through version 0.12.1 are enabled by a login rate-limit bypass: the throttling middleware keys its counter on a client address that is rewritten from the attacker-supplied X-Forwarded-For or X-Real-IP header, so an unauthenticated remote attacker who sends a different forwarded address with every request never trips the limiter. Publicly available exploit code exists (documented in the Ostorlab review and VulnCheck advisory), and the flaw is rated CVSS 4.0 6.9 / assessed CVSS 3.1 6.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); it is not confirmed actively exploited, so exploitation depends on whether the /login endpoint is network-reachable and whether targeted accounts use weak, default, or guessable credentials. The issue is genuine but moderate in severity rather than a top-tier emergency, and its real-world impact is sharply reduced for instances whose admin interface is not exposed to untrusted networks.
Username enumeration in Gophish through 0.12.1 allows unauthenticated remote attackers to distinguish valid administrator accounts from invalid ones by measuring response-time differences in the login handler, which performs a bcrypt comparison for existing users but short-circuits for unknown ones. Rated low-to-moderate priority (CVSS 4.0 6.3; assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N with low confidentiality impact), the flaw yields only a list of valid usernames and does not authenticate an attacker, disclose passwords, or modify data. Publicly available exploit code exists, but there is no evidence of active exploitation and no CISA KEV listing; real-world exposure is sharply limited to deployments where the Gophish admin interface (POST /login) is reachable from an untrusted network, since the recommended deployment keeps it on an internal or VPN-only segment.
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. [CVSS 7.6 HIGH]
Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This affects the package github.com/gophish/gophish before 0.12.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers to cause a denial of service via a clickjacking attack. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Gophish before 0.11.0 allows SSRF attacks. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
Gophish through 0.8.0 allows XSS via a username. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.