CVE-2025-70963

Published Feb 6, 2026

Last updated 3 months ago

CVSS high 7.6

Overview

Description: Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Source: cve@mitre.org
NVD status: Analyzed
Products: gophish

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.6
Impact score: 5.5
Exploitability score: 2.1
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Severity: HIGH

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-200

Hype score: Not currently trending

CVE-2025-70963 Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/Java… https://t.co/egAJolPPCZ
@CVEnew
6 Feb 2026
151 Impressions
0 Retweets
1 Like
0 Bookmarks
0 Replies
0 Quotes

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:getgophish:gophish:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A4CFE238-B15A-44FE-A7FE-A1E359D84FDE",
            "versionEndIncluding": "0.12.1",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

Cross-Site Scripting stored vulnerability in Gophish affecting version 0.12.1. This vulnerability could allow an attacker to store a malicious JavaScript payload in the campaign menu and trigger the payload when the campaign is removed from the menu.•CVE-2024-2211

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References