Gophish API Authentication Bypass via Missing Account Lockout

Executive Summary

CVE-2026-82269 is a vulnerability in Gophish versions up to 0.12.1 where the API authentication middleware fails to enforce account lockout and password change requirements. Attackers with valid API keys can bypass these security controls and retain full API access even if their account is locked or requires a password change.

Useful 0 Not Useful 0

Detection Guidance

Check Gophish logs for unusual API activity, especially requests to endpoints like PUT /api/users/{id}. Monitor for API keys being used by locked accounts or accounts requiring password changes. Review middleware.go for missing AccountLocked and PasswordChangeRequired checks in RequireAPIKey.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with API keys to maintain unauthorized access to the system despite security measures like account lockouts or forced password changes. It could lead to data breaches, unauthorized actions, or prolonged access to sensitive resources.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate account lockouts or password changes for security reasons, such as GDPR's data protection principles or HIPAA's access controls. It may lead to non-compliance and potential legal or regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gophish to a patched version addressing CVE-2026-82269. Temporarily disable API access for affected accounts. Implement additional monitoring for API key usage. Review and restrict PUT /api/users/{id} endpoint permissions to prevent unauthorized account modifications.

Useful 0 Not Useful 0