Gophish up through version 0.12.1 is vulnerable to an insecure direct object reference flaw that allows authenticated users to supply another user’s sequential identifier in POST requests to several API creation endpoints. By pointing the request at /api/groups/, /api/templates/, /api/pages/ or /api/smtp/, an attacker can overwrite the target object and reassign ownership, effectively locking out the original owner and exposing sensitive data such as recipient lists. This type of object takeover constitutes a privilege escalation within the application, compromising confidentiality, integrity and availability of the victim’s resources.

The vulnerability affects the Gophish application; all releases up to and including 0.12.1 are impacted while later stable releases are believed to have applied a fix. Users currently running Gophish v0.12.1 or earlier should be aware that these versions expose groups, templates, landing pages and sending profiles to unauthorized modification.

The CVSS score of 7.1 indicates a high potential for damage if exploited. The EPSS score is not available, but the lack of a KEV listing suggests limited evidence of active exploitation. The exploit requires authenticated access to the Gophish API or web interface; an attacker can craft HTTP POST payloads with a forged user ID to overwrite objects. No additional privileges are required beyond those granted to a legitimate user, so attackers need only obtain valid credentials to proceed.