CVE-2026-107270

HIGH 7.1

Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.

CWE	CWE-639
Vendor	gophish
Product	gophish
Published	Oct 7, 2026

Stay Ahead of the Next One

Get instant alerts for gophish gophish

Be the first to know when new high vulnerabilities affecting gophish gophish are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

gophish / gophish

0 ≤ 0.12.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

blog.ostorlab.co: https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html github.com: https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43 github.com: https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200 github.com: https://github.com/gophish/gophish vulncheck.com: https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints

Credits

Sohaib Harraoui (Ostorlab)