Gophish vulnerabilities
We track 2 vulnerabilities in Gophish products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
2vulnerabilities
0critical
2high
0exploited
7.6average CVSS score
Latest Gophish vulnerabilities
- 7.1 High severity
gophish: Authorization Bypass Through User-Controlled Key
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST request
- 8.1 High severity
gophish: Authentication Bypass Using an Alternate Path or Channel
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or pass