Description

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-28T20:20:17.650Z",
  "pubdate": "2026-08-28T20:20:17.650Z",
  "executiveSummary": "The Gophish application, specifically versions through 0.12.1, exhibits a critical authentication bypass vulnerability within its API middleware. This flaw permits users with a valid API key to maintain persistent, authorized access to the API even when the associated user account has been locked or flagged for a mandatory password change.\nThe vulnerability is classified as an authentication control bypass. It stems from a failure in the API middleware to validate account state flags during the request authentication process. By relying solely on the validity of the API key, the system fails to account for secondary security policies that would otherwise restrict access for compromised or restricted accounts.\nThe impact is significant, as it allows unauthorized or restricted actors to retain full operational control over the platform via the API. This enables the persistence of malicious phishing campaigns and unauthorized exfiltration of sensitive telemetry data, even after security administrators have attempted to disable the specific user profile. Successful exploitation does not require advanced capabilities; an attacker needs only a previously issued, valid API key. This vulnerability exposes organizations to continued unauthorized activity despite proactive account management efforts.",
  "technicalDetails": "The root cause of this vulnerability lies in the decoupling of API authentication logic from the core account management and security policy enforcement modules in Gophish versions through 0.12.1. The API authentication middleware is designed to verify the integrity and existence of an API key; however, it lacks the secondary conditional checks necessary to verify the current status of the associated user account.\nIn a secure implementation, the authentication middleware should perform a multi-layered validation. First, it validates the API key provided in the request header. Second, it performs a state check against the user database to ensure that the 'Locked' status bit is unset and that no 'Force Password Change' flags are present for the user profile. The current implementation in Gophish bypasses these critical secondary checks, effectively treating the API key as a static bypass token.\nThe attack flow proceeds as follows: A threat actor obtains a valid API key through prior legitimate access or credential leakage. When the security administrator identifies suspicious activity or a potential compromise, they perform a standard account lock or trigger a password reset requirement via the web interface. In the vulnerable versions, these actions update the user's state in the backend database. However, when the attacker subsequently submits an API request using the existing, valid API key, the API middleware evaluates only the key. Since the key remains technically valid in the database record, the middleware grants the request, ignoring the 'Locked' or 'Change Password Required' status flags.\nThis behavior results in an authorization bypass where the attacker retains full API functionality, including creating, modifying, or deleting phishing campaigns, as well as extracting collected user data. Because the middleware never cross-references the account status during the API request lifecycle, the attacker is essentially immune to standard administrative lockout procedures. This vulnerability is particularly dangerous in environments where API keys are generated with broad permissions and are not frequently rotated, as it allows attackers to maintain an persistent backdoor into the Gophish infrastructure despite administrative intervention."
}