CVE-2026-107270

{
  "etk_id": "ETK-2026-941",
  "cve_id": "CVE-2026-107270",
  "display_id": "CVE-2026-107270",
  "ghsa_id": "GHSA-5h35-6pm3-mw32",
  "euvd_id": "EUVD-2026-94401",
  "status": "published",
  "anchor_state": "anchored",
  "title": "IDOR in Gophish object-management API",
  "summary": "Gophish versions through 0.12.1 do not adequately enforce ownership checks for several managed objects. An authenticated user may modify or reassign another user's groups, templates, landing pages, or sending profiles, potentially exposing recipient data or denying the owner access. Access to an authenticated Gophish account or API session is required.",
  "mitigation": "Restrict Gophish administrative and API access to trusted users and networks, and review user accounts and object ownership for unauthorized changes. Monitor for a vendor update and upgrade promptly when a fixed release is published.",
  "vendor": "gophish",
  "product": "gophish",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 0.12.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "gophish",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.002,
  "epss_percentile": 0.0924,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.4279477,
  "t0_at": "2026-10-07T15:44:03.555000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T15:44:03.555000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T15:44:03.555000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107270"
    }
  }
}