CVE-2025-70963

Published: Feb 6, 2026Modified: Jun 17, 2026

7.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Exploitability: 2.1 / Impact: 5.5

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

Affected (1)

Products: Getgophish: Gophish

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Getgophish Gophish	Up to 0.12.1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

References (1)

https://github.com/gophish/gophish/issues/9366

Source: cve@mitre.org

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.