CVE-2025-70963

n/a / n/a PUBLISHED

Description (CNA)

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://github.com/gophish/gophish/issues/9366

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.