High severity · published Aug 28, 2026
CVE-2026-82269
Gophish Account Lockout and Forced Password Change Bypassable via API Key
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
gophish · gophish
through 0.12.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82269
github.com
https://github.com/gophish/gophish
github.com
https://github.com/gophish/gophish/blob/95618469799295e2c0fec980805a2dfbb818816b/middleware/middleware.go
github.com
https://github.com/gophish/gophish/issues/9440
www.vulncheck.com
https://www.vulncheck.com/advisories/gophish-account-lockout-and-forced-password-change-bypassable-via-api-key
More from gophish
7.1
CVE-2026-107270
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
6.5
CVE-2026-39904
Gophish 0.12.1 Denial of Service via Office Document Upload
5.3
CVE-2026-107271
Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing
4.7
CVE-2026-107272
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
4.3
CVE-2026-107273
Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site