Gophish <=0.12.1 is vulnerable to Incorrect Access Control.
Priority HIGH 66CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-284.
Summary
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00304 23rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/gophish/gophish (Go) | up to 0.12.1 | — | No fix listed | GHSA-9f8m-9547-2gqm |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/gophish/gophish (Go) Vendor— Affected up to 0.12.1 Fixed in — No fix listed GHSA-9f8m-9547-2gqm
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:getgophish:gophish:*:*:*:*:*:*:*:* | up to 0.12.1 | Vulnerable | Getgophish |
- cpe:2.3:a:getgophish:gophish:*:*:*:*:*:*:*:* Versions up to 0.12.1 Vulnerable ·Getgophish
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-70963
- 2026-10-03 Alias added: GHSA-9f8m-9547-2gqm
References
More Getgophish Gophish vulnerabilities
- TI-2022-22115 Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. CVSS 3.1HIGH 7.5
- TI-2022-22116 Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. CVSS 3.1MEDIUM 6.1
- TI-2020-15165 Gophish before 0.11.0 allows the creation of CSV sheets that contain malicious content. CVSS 3.1HIGH 7.8
- TI-2020-15171 Gophish through 0.10.1 does not invalidate the gophish cookie upon logout. CVSS 3.1HIGH 7.5
- TI-2020-15169 The Reset button on the Account Settings page in Gophish before 0.11.0 allows attackers… CVSS 3.1MEDIUM 6.5
- TI-2024-02053 Cross-Site Scripting vulnerability in Gophish Admin Panel CVSS 3.1MEDIUM 6.1
Sources
- CVE-2025-70963 · CVE Program
- CVE-2025-70963 · NVD
- FIRST EPSS
- GHSA-9f8m-9547-2gqm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences