Cyber Posture

CVE-2025-70963

HighPublic PoC

Published: 06 February 2026

Published
06 February 2026
Modified
10 February 2026
KEV Added
Patch
CVSS Score 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
EPSS Score 0.0002 4.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-70963 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Getgophish Gophish. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Application Access Token (T1528); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Steal Application Access Token (T1528).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200 CWE-922

Documenting information locations and authorized users enables better protection against unauthorized exposure of sensitive data.

addresses: CWE-200 CWE-922

Requiring equivalent controls at the alternate storage site prevents unauthorized exposure of sensitive backup data.

addresses: CWE-200 CWE-922

Protecting confidentiality of backup information prevents unauthorized exposure of sensitive data stored in backups.

addresses: CWE-200 CWE-922

Policies mandate protection of CUI on external systems, directly reducing unauthorized exposure of sensitive information.

addresses: CWE-200 CWE-922

Categorization identifies sensitive data so that confidentiality protections commensurate with impact level are selected and documented.

addresses: CWE-200 CWE-922

Encrypting or otherwise protecting data at rest directly prevents unauthorized actors from reading sensitive information stored on disk or other media.

addresses: CWE-200 CWE-922

Fragmentation across systems ensures that exposure from any single component yields only incomplete information, directly reducing the impact of unauthorized disclosure.

addresses: CWE-200 CWE-922

OPSEC controls directly protect supply chain information from unauthorized observation or disclosure.

MITRE ATT&CK Enterprise TechniquesAI

T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
Why these techniques?

Vulnerability directly exposes long-lived API keys in client-side HTML/JS, enabling theft of application access tokens by any browser-context script.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the…

more

browser context.

Deeper analysisAI

CVE-2025-70963 is an incorrect access control vulnerability (CWE-200, CWE-922) affecting Gophish versions <=0.12.1. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HTML/JavaScript of the page on every login. This makes permanent API credentials accessible to any script running in the browser context. The vulnerability has a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L) and was published on 2026-02-06T18:15:55.510.

The attack requires low-privileged access (PR:L) over the network (AV:N) with low attack complexity (AC:L) and user interaction (UI:R), such as logging into the dashboard. Once a victim authenticates, any script executing in the browser context can extract the exposed API key. Attackers with the key can achieve high confidentiality and integrity impacts (C:H/I:H) along with low availability impact (A:L), enabling unauthorized actions via the Gophish API.

Mitigation details are available in the GitHub issue at https://github.com/gophish/gophish/issues/9366.

Details

CWE(s)

Affected Products

getgophish
gophish
≤ 0.12.1

CVEs Like This One

CVE-2025-21620Shared CWE-200
CVE-2026-33745Shared CWE-200
CVE-2026-40895Shared CWE-200
CVE-2026-40868Shared CWE-922
CVE-2026-33180Shared CWE-200
CVE-2026-34969Shared CWE-200
CVE-2025-28244Shared CWE-922
CVE-2026-41323Shared CWE-200
CVE-2026-26069Shared CWE-200
CVE-2026-30845Shared CWE-200

References