CVE-2026-82269

HighCVSS 8.1/10Last modified Sep 23, 2026

Description

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Sep 23, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-82278.8A weakness has been identified in Wavlink NU516U1 240425. This issue affects the function wzdapMesh of the file /cgi-bin/adm.cgi. This manipCVE-2026-822707.5Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator CVE-2026-822716.5R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modCVE-2026-822726.5Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing thCVE-2026-822736.5Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceIdCVE-2026-822744.7Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats tCVE-2026-822757.5Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended direCVE-2026-822765.3StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly insteCVE-2026-822779.8Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorizationCVE-2026-822788.8BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to exeCVE-2026-822798.1HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform adminisCVE-2026-82288.8A security vulnerability has been detected in Wavlink NU516U1 240425. Impacted is the function advance of the file /cgi-bin/wireless.cgi. Su