CVE-2026-82269: Gophish Auth Bypass Vulnerability

CVE-2026-82269 Overview

CVE-2026-82269 is an authentication bypass vulnerability in Gophish through version 0.12.1. The flaw resides in the API authentication middleware, which fails to enforce account lockout and forced password change requirements. Attackers holding valid API keys retain full API access even when the associated account is locked or flagged for password reset. The weakness is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Compromised or leaked Gophish API keys grant persistent, high-privilege access to phishing campaign infrastructure, bypassing account lockout and password rotation controls intended to contain credential compromise.

Affected Products

Gophish through version 0.12.1
Gophish API authentication middleware (middleware/middleware.go)
Deployments relying on account lockout or forced password change as compensating controls

Discovery Timeline

2026-08-28 - CVE-2026-82269 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82269

Vulnerability Analysis

Gophish is an open-source phishing simulation framework used by security teams to run authorized social engineering assessments. The platform supports two authentication paths: interactive session-based login for the web UI and API key authentication for programmatic access. The API middleware validates the API key but skips the state checks that the session path enforces.

When an administrator locks an account after failed logins or requires a password change, those controls only apply to the login handler. The API middleware treats a valid API key as sufficient authorization, ignoring the account state stored alongside the user record. An attacker with a stolen or previously issued API key retains full CRUD access to campaigns, templates, landing pages, sending profiles, and result data.

Root Cause

The root cause is missing authorization state validation in the API middleware. The middleware verifies key ownership but does not re-check whether the underlying account is locked (AccountLocked) or flagged for mandatory password change. This violates the principle that all authentication paths must enforce the same policy state, a classic manifestation of CWE-288. See the Gophish middleware source referenced in the advisory.

Attack Vector

Exploitation requires a valid API key for a Gophish user. An attacker who obtains such a key through phishing, source code leakage, backup exposure, or prior compromise can continue calling /api/* endpoints after the account has been locked. The attacker can enumerate campaigns, exfiltrate captured credentials, send new phishing waves, and modify landing pages. The VulnCheck advisory and Gophish issue #9440 document the behavior.

// No verified exploit code is published for this CVE.
// The bypass is behavioral: authenticated API requests
// using a valid key succeed against endpoints such as
//   GET /api/campaigns/
//   GET /api/results/
// even after the owning account is locked or password-change-required.

Detection Methods for CVE-2026-82269

Indicators of Compromise

API requests to /api/* endpoints originating from accounts that have been marked locked or flagged for password reset in the Gophish database.
Successful HTTP 200 responses on API routes correlated with failed interactive login attempts for the same user.
Unexpected campaign creation, sending profile modification, or bulk result exports outside normal operational windows.

Detection Strategies

Enable HTTP access logging on the Gophish reverse proxy and alert on API activity from user IDs whose account state is locked or pending password change.
Cross-reference API key usage against user status fields in the Gophish users table to identify state mismatches.
Baseline normal API caller source IPs and flag deviations, particularly access from cloud provider ranges not used by the security team.

Monitoring Recommendations

Forward Gophish application and proxy logs to a centralized analytics platform for retention and correlation with identity events.
Track API key issuance, rotation, and revocation events and alert on keys used after an associated account lock.
Monitor outbound network traffic from the Gophish host for phishing traffic sent outside authorized engagement windows.

How to Mitigate CVE-2026-82269

Immediate Actions Required

Rotate all Gophish API keys, especially for any account that has been locked, disabled, or flagged for password change.
Restrict network access to the Gophish API using firewall rules, VPN gating, or an authenticating reverse proxy that enforces user status independently.
Audit recent API activity for signs of use by locked accounts and treat any matches as potential compromise.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry for versions after Gophish 0.12.1. Monitor the Gophish repository and issue #9440 for an official fix, and review the VulnCheck advisory for coordinated remediation guidance.

Workarounds

Revoke API keys immediately when locking an account or requiring a password change, since the middleware does not honor those states.
Place Gophish behind a reverse proxy that validates a session cookie or mutual TLS certificate in addition to the API key.
Limit API key scope by issuing distinct keys per operator and disabling unused accounts entirely rather than relying on lockout.

bash

# Example: revoke a Gophish API key by rotating it in the database
# (stop Gophish before editing the SQLite store)
sqlite3 gophish.db "UPDATE users SET api_key = lower(hex(randomblob(32))) WHERE username = 'locked_user';"

# Example: restrict API exposure at the reverse proxy (nginx)
location /api/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass https://127.0.0.1:3333;
}