An authenticated access control flaw in Gophish versions 0.12.1 and earlier allows for the exposure of permanent API keys, posing a high risk of unauthorized system access.

This vulnerability is an incorrect access control issue where the administrative dashboard inadvertently renders long-lived API keys within the browser's document object model, accessible to any authenticated user with access to the dashboard.

The exposure of permanent API keys permits an attacker to perform unauthorized actions on behalf of the administrative user, potentially leading to full system compromise or data exfiltration. With a CVSS score of 7.6, this vulnerability is classified as High, reflecting the significant potential for unauthorized access to sensitive phishing campaign infrastructure and operational data.

Immediate Action: As no specific patch is currently listed, administrators should restrict access to the Gophish administrative dashboard to trusted networks only and rotate all existing API keys immediately.

Proactive Monitoring: Review application access logs for unusual patterns originating from administrative accounts and monitor for suspicious API calls that do not align with known campaign management activity.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent proxy to limit access to the administrative console and employ strict Content Security Policy (CSP) headers to mitigate potential client-side script execution.

Public Exploit Available: exploit_available (unknown)

Given the severity of credential exposure, organizations must prioritize the isolation of the Gophish administrative interface. Until a formal patch is released by the vendor, administrators must treat all current API keys as compromised, rotate them, and strictly limit access to the dashboard to mitigate the risk of unauthorized exploitation.