A vulnerability in the Gophish API authentication middleware allows attackers with valid API keys to bypass account lockout and forced password change requirements, posing a significant risk of unauthorized access persistence.

The application utilizes an authentication middleware, specifically the RequireAPIKey function, which fails to validate the current account status against security policies such as lockouts or pending password resets. Consequently, an authenticated user possessing a valid API key maintains full access to the API even after their account should have been restricted or forced into a password change state.

This vulnerability carries a high risk, as reflected in the CVSS score of 8.1. By bypassing security controls, an attacker can maintain persistent, unauthorized control over phishing campaigns or sensitive organizational data managed within the Gophish platform. This could lead to the compromise of internal communications, reputational damage, and the continued operation of malicious infrastructure even after administrators have attempted to disable the compromised account.

Immediate Action: Administrators should review all active API keys and rotate them frequently while monitoring for a vendor-supplied patch to address the middleware logic.

Proactive Monitoring: Review application access logs for anomalous API activity originating from accounts that are flagged for password resets or that should have been locked due to suspicious behavior.

Compensating Controls: Implement strict network-level access controls to limit API endpoint access to trusted IP addresses, thereby reducing the exposure of the vulnerable middleware to potential attackers.

Public Exploit Available: No

The inability of the Gophish API middleware to respect account lockout and password change states is a critical failure in the security lifecycle of the application. Organizations utilizing Gophish must treat this as a high-priority issue, as it effectively renders account management policies useless against an attacker who has obtained a valid API key. Apply vendor updates immediately upon release to restore integrity to the authentication process.