CVE-2025-70963: Getgophish Gophish

High severity, CVSS 7.6. EPSS: 0.3% chance of exploitation in the next 30 days.

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

Affected products

• Getgophish Gophish: up to and including 0.12.1

Published 2026-02-06. Last modified 2026-06-17.