GHSA-9f8m-9547-2gqm
Gophish is vulnerable to Incorrect Access Control
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/gophish/gophish | <= 0.12.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Gophish <= 0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
References
External links from the advisory. They lead to third-party sites.