CVE-2026-82269: Gophish Account Lockout and Forced Password Change Bypassable via API Key
Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Gophish installations through version 0.12.1 are affected if an attacker has a valid API key for an account that has been locked or is required to change its password.
What does an attacker need to exploit the bypass?
The attacker needs a valid API key. No user interaction is required, and the issue is reachable over the network.
What access does the bypass provide?
A valid API key can continue to provide full API access despite account lockout or a forced password-change requirement. The reported impact includes high confidentiality and integrity impact.