CVE-2026-82269

HIGH 8.1

Gophish Account Lockout and Forced Password Change Bypassable via API Key

CVSS Score

8.1

EPSS Score

0.0%

EPSS Percentile

0th

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

CWE	CWE-288
Vendor	gophish
Product	gophish
Published	Aug 28, 2026
Last Updated	Aug 28, 2026

Stay Ahead of the Next One

Get instant alerts for gophish gophish

Be the first to know when new high vulnerabilities affecting gophish gophish are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

gophish / gophish

0 ≤ 0.12.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gophish/gophish/issues/9440 github.com: https://github.com/gophish/gophish github.com: https://github.com/gophish/gophish/blob/95618469799295e2c0fec980805a2dfbb818816b/middleware/middleware.go vulncheck.com: https://www.vulncheck.com/advisories/gophish-account-lockout-and-forced-password-change-bypassable-via-api-key

Credits

🔍 George Chen