Login Request a demo
High severity · published Oct 7, 2026
CVE-2026-107270
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
gophish · gophish
through 0.12.1 · source: vendor
Affected product
GO
gophish
gophish
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107270
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107270
technical-description
https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
technical-description
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43
technical-description
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200
product
https://github.com/gophish/gophish
third-party-advisory
https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints
More from gophish
8.1
CVE-2026-82269
Gophish Account Lockout and Forced Password Change Bypassable via API Key
6.5
CVE-2026-39904
Gophish 0.12.1 Denial of Service via Office Document Upload
5.3
CVE-2026-107271
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
4.7
CVE-2026-107272
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
4.3
CVE-2026-107273
Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site