CVE-2026-82269highCWE-288

CVE-2026-82269: falha de alta gravidade em gophish

Gophish Account Lockout and Forced Password Change Bypassable via API Key

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar gophish

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.6epss 0.6%
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
gophish · gophish
CVEs relacionadas — gophish

No mesmo produto, das mais perigosas para as menos.

CVE-2026-39904HIGHGophish 0.12.1 Denial of Service via Office Document UploadEPSS 0.4%CVE-2026-107269MEDIUMGophish through 0.12.1 Username Enumeration via POST /login Timing DiscrepancyEPSS 0.2%CVE-2026-107273MEDIUMGophish 0.11.0 through 0.12.1 SSRF via POST /api/import/siteEPSS 0.2%CVE-2026-107270HIGHGophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create EndpointsEPSS 0.2%CVE-2026-107272LOWGophish through 0.12.1 XSS via Unescaped SMTP Server Error MessagesEPSS 0.2%CVE-2026-107271MEDIUMGophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For SpoofingEPSS 0.2%