CVE-2026-107270 gophish CVE debrief

Who should care

Defenders responsible for Gophish installations, security teams, and administrators of phishing campaign infrastructure should assess exposure and prioritize remediation. This includes IT personnel managing Gophish deployments, security professionals responsible for vulnerability management, and operators using Gophish for phishing simulations or security testing. These stakeholders should verify their Gophish version, review the official advisory, and

Why it matters

CVE-2026-107270 is a high-severity vulnerability in Gophish that allows authenticated users to take over sensitive objects. Defenders should prioritize verification and remediation, especially in security-sensitive environments.

• Potential unauthorized access to sensitive information
• Possible disruption of phishing campaigns or security operations
• Risk of privilege escalation for attackers
• Need for verification of Gophish version and remediation

Technical summary

The vulnerability allows authenticated users to take over other users' groups, templates, landing pages, and sending profiles in Gophish through version 0.12.1. This is achieved by supplying another user's sequential ID in POST requests to /api/groups/, /api/templates/, /api/pages/, or /api/smtp/. The insecure direct object reference vulnerability can lead to unauthorized access and control of sensitive objects within the Gophish application, potentially disrupting phishing campaigns or security operations. Defenders should prioritize verifying and remediating this vulnerability, especially in environments where Gophish is used for phishing campaigns or other security-sensitive operations.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability, especially in environments where Gophish is used for phishing campaigns or other security-sensitive operations.

Recommended defensive actions

• Verify Gophish version and upgrade to a patched version if available
• Restrict API access to trusted users and validate input IDs
• Monitor Gophish logs for suspicious API activity
• Implement additional authentication and authorization checks for API endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is described in the CVE record and confirmed by the affected vendor. Technical details are provided in researcher disclosure and source code references. The CVE record was published on 2026-10-07T15:44:03.555Z and has not been modified since then. The vulnerability allows attackers to supply another user's sequential ID in POST requests to /api/groups/, /api/templates/, /api/pages/, or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists. Defenders should verify Goph

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.