Is CVE-2026-82269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82269 being exploited in the wild.

How severe is CVE-2026-82269?

High severity, with a CVSS score of 8.1, published 28 August 2026.

Is there a fix for CVE-2026-82269?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82269 attacked?

It is attacked over the network.

Am I affected by CVE-2026-82269?

Check whether you run Gophish at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82269: Gophish API authentication bypass via account lockout enforcement failure

CVE-2026-82269 · Severity: high · CVSS 8.1 · Published 2026-08-28

Gophish is an open-source phishing simulation toolkit used by security teams to test organizational defenses. This vulnerability allows attackers with a valid API key to maintain full API access even after an administrator locks the account or forces a password change. An attacker could continue to create phishing campaigns, exfiltrate campaign data, or modify settings without any access restrictions.

Quick answers

Is CVE-2026-82269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82269 being exploited in the wild.
How severe is CVE-2026-82269?: High severity, with a CVSS score of 8.1, published 28 August 2026.
Which products and versions are affected?: Gophish through 0.12.1.
Is there a fix for CVE-2026-82269?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82269 attacked?: It is attacked over the network.
Am I affected by CVE-2026-82269?: Check whether you run Gophish at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Gophish through version 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. The vulnerability exists in the middleware.go component, which does not validate account status (locked or password-change-required state) during API key authentication. An attacker with a valid API key can bypass these security controls and retain full API access to protected endpoints. The attack requires a valid, pre-obtained API key but does not require network authentication beyond that. Patches are expected in versions after 0.12.1.

Affected products

Gophish Gophish through 0.12.1

Timeline

2026-08-28: disclosed
2026-08-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.