CVE-2025-70963 Gophish is vulnerable to Incorrect Access Control
Attackers can steal long-lived API keys from the admin dashboard HTML, enabling unauthorized access to Gophish accounts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-70963?
CVE-2025-70963 is a high-severity vulnerability in n/a, published on 6 Feb 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
Which versions are affected by CVE-2025-70963?
3 open source packages ship an affected version, including github.com/gophish/gophish. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gophish/gophish Go | All versions | None |
github.com/gophish/gophish Go | All versions to 0.12.1 | None |
github.com/gophish/gophish Go | All versions to 0.12.1 | None |
Products include Getgophish Gophish.
How do I fix CVE-2025-70963?
Upgrade to a fixed version.
Is CVE-2025-70963 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-70963 exists.
Other vulnerabilities in n/a
- CVE-2020-24707 Other in n/a
- CVE-2022-45003 Gophish vulnerable to Denial of Service via crafted payload involving autofocus
- CVE-2020-24713 Security feature bypass in n/a
- CVE-2020-24711 Cross-site request forgery in n/a
- CVE-2022-45004 Gophish vulnerable to Cross-site Scripting via crafted landing page
Sources
Also known as GHSA-9f8m-9547-2gqm, GO-2026-4455.