CVE-2026-82269

HighCVSS 8.1

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 29/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

Risk Assessment

The risk includes unauthorized access to API functionality despite account lockout, potentially leading to data integrity issues and unauthorized actions in the system.

Recommendation

It is recommended to upgrade Gophish to a version that enforces account lockout and password change requirements in the API, and to review and rotate API keys to secure access.

Other vulnerabilities in Gophish

CVE-2026-39904Medium
Gophish through version 0.12.1 contains a denial of service vulnerability that allows authenticated users with the User role to exhaust server memory by uploading a crafted Office document as an email template attachment. The ApplyTemplate() function in models/attachment.go processes Office documents as ZIP archives and calls ioutil.ReadAll() on each contained file entry without enforcing size restrictions on uncompressed content, allowing a zip bomb payload to expand to several gigabytes in memory and cause the process to be terminated by the operating system.

Original NVD description (English source)