CVE-2025-70963: getgophish gophish
Vulnerability summary
CVE-2025-70963 is a high (CVSS 7.6) vulnerability in getgophish gophish. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 23.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 06-02-2026PublishedVulnerability first disclosed.
- 06-02-2026Last modifiedVulnerability information updated.
Description
Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context.
CVSS metrics
3 scores · 3 sources · 2 versions- NVDNIST7.6HighCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.31% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundGophish
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-922Insecure Storage of Sensitive InformationThe product stores sensitive information without properly limiting read or write access by unauthorized actors.
Affected systems
Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Getgophish1 product
- gophish≤ 0.12.1
Github.com/gophish1 product
- gophish≤ 0.12.1 | All versions (No fix recorded)
2 vendors · 2 products
References
4 links
- github.com/gophish/gophishPACKAGE