CVE-2026-107270: Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-07 · updated 2026-10-07
Weakness: CWE-639

Description

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.

Affected products

gophish: through 0.12.1

References

https://blog.ostorlab.co/gophish-0121-manual-review-agentic-deep-scan.html
https://github.com/gophish/gophish
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/controllers/api/group.go#L28-L43
https://github.com/gophish/gophish/blob/b1648f0759c6d57ac989157c55d8b47c40254fe6/models/group.go#L194-L200
https://www.vulncheck.com/advisories/gophish-through-0.12.1-object-takeover-via-client-supplied-id-on-api-create-endpoints

Get alerted when CVE-2026-107270 or the next vulnerability affects your stack