PT-2026-6752 · Gophish · Gophish

Published 2026-02-06 · Updated 2026-03-03 · CVE-2025-70963

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Gophish versions prior to 0.12.1

Description The administrative dashboard reveals each user’s long-lived API key within the HTML and JavaScript code on every login. This exposes permanent API credentials to any script operating within the browser environment. The vulnerable component is the administrative dashboard. The API key is exposed through the rendered HTML/JavaScript.

Recommendations Update to a version greater than 0.12.1.

Fix

Improper Access Control

Insecure Storage of Sensitive Information

Information Disclosure

Weakness Enumeration

CWE-284

CWE-922

CWE-200

Related Identifiers

CVE-2025-70963

GHSA-9F8M-9547-2GQM

GO-2026-4455

SUSE-SU-2026:0757-1

Affected Products

Gophish

References · 114

• https://github.com/gophish/gophish/issues/9366 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-70963 · Security Note
• https://osv.dev/vulnerability/GHSA-9f8m-9547-2gqm · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-70963 · Vendor Advisory
• https://github.com/gophish/gophish · Note
• https://suse.com/security/cve/CVE-2026-27112 · Note
• https://suse.com/security/cve/CVE-2026-25760 · Note
• https://suse.com/security/cve/CVE-2026-26957 · Note
• https://suse.com/security/cve/CVE-2026-26055 · Note
• https://suse.com/security/cve/CVE-2017-18903 · Note
• https://suse.com/security/cve/CVE-2026-24851 · Note
• https://suse.com/security/cve/CVE-2026-25882 · Note
• https://suse.com/security/cve/CVE-2026-25934 · Note