CVE-2026-107270

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-10-07

Modified

2026-10-07

Record from

the NVD, synced 2026-10-19

References

• https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
• https://github.com/gophish/gophish
• https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43
• https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200
• https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints

Check your stackJSON