{"id":"CVE-2026-82269","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-82269","generatedAt":"2026-10-28T09:26:50.047Z","title":"Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.","description":"Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.","published":"2026-08-28T20:20:18.000Z","lastModified":"2026-09-23T17:17:44.000Z","status":"Deferred","sourceIdentifier":"disclosure@vulncheck.com","cvss":{"version":"4.0","score":8.6,"severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-288"],"affected":[],"epss":{"score":0.00551,"percentile":0.45895,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/gophish/gophish","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gophish/gophish/blob/95618469799295e2c0fec980805a2dfbb818816b/middleware/middleware.go","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gophish/gophish/issues/9440","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/gophish-account-lockout-and-forced-password-change-bypassable-via-api-key","source":"disclosure@vulncheck.com"},{"url":"https://github.com/gophish/gophish/issues/9440","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-82269","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}