Vulnerability · Published Oct 7, 2026 · Assigned by VulnCheck

CVE-2026-107270Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

High 7.1

In plain English

A high-severity authorization bypass via user-controlled key in gophish from gophish. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 90.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.

Affected products (as reported)

Vendor	Product	Versions
gophish	gophish	0 – through 0.12.1

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

References

Researcher Disclosure technical-description, exploit
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43 technical-description
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200 technical-description
https://github.com/gophish/gophish product
VulnCheck Advisory: Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints third-party-advisory