Executive brief
Gophish is an open-source phishing simulation toolkit used by security teams to test organizational defenses. This vulnerability allows attackers with a valid API key to maintain full API access even after an administrator locks the account or forces a password change. An attacker could continue to create phishing campaigns, exfiltrate campaign data, or modify settings without any access restrictions.
Technical details
Gophish through version 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. The vulnerability exists in the middleware.go component, which does not validate account status (locked or password-change-required state) during API key authentication. An attacker with a valid API key can bypass these security controls and retain full API access to protected endpoints. The attack requires a valid, pre-obtained API key but does not require network authentication beyond that. Patches are expected in versions after 0.12.1.
Affected products
- Gophish Gophish through 0.12.1
Timeline
- 2026-08-28: disclosed
- 2026-08-28: advisory