CVE-2026-107273 gophish CVE debrief

Who should care

Defenders responsible for Gophish instances, especially those with authenticated low-privileged users, should assess exposure and prioritize verification and remediation. This includes reviewing and updating the dialer deny list to block internal URLs, monitoring for suspicious activity, and implementing additional security controls to prevent lateral movement. Security teams should also review incident response plans to ensure readiness in case of an

Why it matters

Defenders should prioritize verifying exposure of Gophish instances, especially those with authenticated low-privileged users, and assess the impact of potential internal host and port enumeration.

• Potential internal host and port enumeration
• Possible reading of service responses
• Increased risk of lateral movement
• Need for verification of exposure and remediation

Technical summary

The vulnerability allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site, potentially leading to internal host and port enumeration. This could allow attackers to read service responses and enumerate internal hosts and ports through error messages. The default dialer deny list does not block internal URLs, which can be submitted by attackers to exploit this vulnerability. Defenders should prioritize verifying exposure of Gophish instances, especially those with authenticated low-privileged users, and assess the impact of potential internal host and port enumeration.

Defensive priority

Defenders should prioritize verifying exposure of Gophish instances, especially those with authenticated low-privileged users, and assess the impact of potential internal host and port enumeration.

Recommended defensive actions

• Verify exposure of Gophish instances, especially those with authenticated low-privileged users
• Assess the impact of potential internal host and port enumeration
• Review and update the dialer deny list to block internal URLs
• Monitor for suspicious activity on Gophish instances
• Perform vulnerability scanning to identify potential targets
• Implement additional security controls to prevent lateral movement
• Review incident response plans to ensure readiness

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to technical descriptions and exploit information. Defenders should verify the exposure of Gophish instances, especially those with authenticated low-privileged users, and assess the impact of potential internal host and port enumeration. The default dialer deny list does not block internal URLs, allowing attackers to submit them to read service responses and enumerate internal hosts and ports through error

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.