CVE-2026-107270: falha de alta gravidade em gophish
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
Publicada em
38Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 7.1
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
gophish · gophishPoCs públicas encontradas — 1
cve_referenceblog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — gophish
No mesmo produto, das mais perigosas para as menos.
CVE-2026-39904HIGHGophish 0.12.1 Denial of Service via Office Document UploadEPSS 0.4%CVE-2026-82269HIGHGophish Account Lockout and Forced Password Change Bypassable via API KeyEPSS 0.4%CVE-2026-107273MEDIUMGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/siteEPSS —CVE-2026-107272LOWGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesEPSS —CVE-2026-107271MEDIUMGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingEPSS —CVE-2026-107269MEDIUMGophish through 0.12.1 Username Enumeration via POST /login Timing DiscrepancyEPSS —
Referências
https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.htmlhttps://github.com/gophish/gophishhttps://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints