CVE-2025-70963 Details
Description
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
An incorrect access control vulnerability has been identified in Gophish versions through 0.12.1. The issue arises because the administrative dashboard exposes each user's long-lived API key in cleartext within the HTML and JavaScript of the page upon login. This exposure allows any script running in the browser context to access these permanent API credentials. The vulnerability enables persistent access to the application's REST API, as the API key remains valid outside of the web session. Regenerating the API key does not resolve the issue, as the new key is also embedded and exposed on subsequent logins.
It is recommended to avoid embedding long-lived API credentials in client-side HTML or JavaScript. Instead, use short-lived session-bound tokens for user interface operations and only display API keys when explicitly requested by the user.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gophish/gophish/issues/9366 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
| CWE-922 | Insecure Storage of Sensitive Information | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| getgophish gophish | <= 0.12.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 10, 2026 | Initial Analysis | [email protected] |
| Feb 6, 2026 | CVE Modified | CISA-ADP |
| Feb 6, 2026 | New CVE Received | [email protected] |