CVE-2026-107270

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-107270
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107270.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-107270
Published
2026-10-07T15:44:03Z
Modified
2026-10-08T02:50:36Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
Details

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/, /api/pages/ or /api/smtp/ to overwrite and reassign objects, locking out owners and exposing victims' recipient lists.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-639"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107270.json"
}
References

Affected packages

Git / github.com/gophish/gophish

Affected ranges

Type
GIT
Repo
https://github.com/gophish/gophish
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
b1648f0759c6d57ac989157c55d8b47c40254fe6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.12.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.7.1
v0.*
v0.1
v0.1.1
v0.1.2
v0.10.0
v0.10.1
v0.11.0
v0.12.0
v0.12.1
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.8.0
v0.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107270.json"