CVE-2026-82269highCWE-288

CVE-2026-82269: fallo de gravedad alta en gophish

Gophish Account Lockout and Forced Password Change Bypassable via API Key

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear gophish

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.6%
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Productos afectados
gophish · gophish
CVEs relacionadas — gophish

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-39904HIGHGophish 0.12.1 Denial of Service via Office Document UploadEPSS 0.4%CVE-2026-107269MEDIUMGophish through 0.12.1 Username Enumeration via POST /login Timing DiscrepancyEPSS 0.2%CVE-2026-107273MEDIUMGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/siteEPSS 0.2%CVE-2026-107270HIGHGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create EndpointsEPSS 0.2%CVE-2026-107272LOWGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesEPSS 0.2%CVE-2026-107271MEDIUMGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingEPSS 0.2%