Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups,… (CVE-2026-107270)

Gophish through version 0.12.1 contains an insecure direct object reference (IDOR) vulnerability (CWE-639) that allows authenticated users to manipulate API endpoints (/api/groups/, /api/templates/, /api/pages/, /api/smtp/) by supplying another user's sequential ID in POST requests. This enables attackers to overwrite and reassign objects such as groups, templates, landing pages, and sending profiles, effectively taking over these resources and locking out the original owners. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity, with network attack vector, low attack complexity, and requiring privileges but no user interaction. Confidentiality impact is low, integrity impact is high, and availability impact is none.

Authenticated attackers can take control of other users' groups, templates, landing pages, and sending profiles within Gophish by exploiting the IDOR vulnerability. This can result in unauthorized reassignment of these objects, locking out legitimate owners and exposing sensitive recipient lists. The integrity of user data and configurations is compromised, but availability is not affected. Confidentiality impact is limited to exposure of recipient lists.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to authenticated users carefully and monitor for suspicious activity related to object reassignment. Avoid sharing sequential IDs in API requests or implement additional access controls to prevent unauthorized object manipulation.