IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-02-06 18:15

MODIFIED

2026-02-06 18:15

EPSS (Prob. Exploit)

0.30%

Top 76.7%

DATA SOURCES:

NVD 🔗 2026-02-06 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-10-28 OSV 🔗 2026-11-08

> DESCRIPTION

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-9f8m-9547-2gqm MODERATE

Gophish is vulnerable to Incorrect Access Control

AFFECTED PACKAGES:

GO / github.com/gophish/gophish

<= 0.12.1

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

17 versions affected

ALIASES:

GHSA-9f8m-9547-2gqm, GO-2026-4455

> HISTORIQUE DES MODIFICATIONS

Première apparition

06/02/2026 18:15

Source: NVD

Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/gophish/gophish/issues/9366