CVE-2026-107270: Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
Published Oct 7, 2026
·Updated
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.
Affected Software
1 affected component
Gophish Gophish<=0.12.1
Event History
Oct 7, 2026
CVE Published
via MITRE·03:44 PM
Data Sourced
via MITRE·03:44 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require victim interaction?
No. The vector indicates no user interaction is required once an attacker has the necessary authenticated access.
2
What level of access does an attacker need?
The attacker needs network access to the affected API and low-level authenticated privileges. No higher administrative privilege requirement is indicated.