v0.16.0 - Teams, Auditor and IMAP Improvements

This release brings a batch of new features on top of the modernization work from v0.15.1: multi-user teams, a read-only auditor role, OAuth2 for IMAP reporting, and a rewritten IMAP monitor that no longer fails silently. Alongside that, a long list of bug fixes carried over from triaging upstreams open issue backlog, and the Docker image has been rebuilt to match the current toolchain.

New features

• Teams: campaigns, templates, landing pages, and other assets can now be shared across multiple user accounts on the same team, instead of every account working in its own silo.
• Auditor role: a read-only permission level for reviewers and clients.
• OAuth2 for IMAP reporting (Google, Microsoft, or custom provider).
• SMTP CC recipients on sending profiles.
• Resend failed mail, single or all failed at once.
• Added {{.DOMAIN}} template placeholder.
• Dashboard onboarding checklist replacing the bare "no campaigns yet" message.
• IMAP monitor overhaul

Multiple Bug fixes
Mail validation/Punycode, duplicate-name constraint, a caching issue suspected behind upstream #2022, a performance bug, a startup failure on modified admin users, a MailLog deadlock, a connection pool issue, the report button (mixed-content blocking), minor API GET/POST misuse, duplicate hash generation, and the password-reset success message.

Docs
First version of user guide migrated to MkDocs, API docs extended.

v0.15.1 - First release of this fork

This is the first release from this fork of Gophish. Upstream gophish/gophish has had no commits since September 2024, so this release focuses on catching up on five years of dependency drift, fixing real bugs found along the way, and bringing CI up to a standard that catches regressions before they ship. It's built on the same database schema and config format as upstream - if you're running an existing Gophish install, this should be a drop-in replacement.

Security fixes

• Stored XSS in the campaign delete confirmation dialog. The campaign name was interpolated into the SweetAlert2 dialog without escaping, unlike every other page in the app (groups, templates, landing pages, sending profiles, users, webhooks all escaped the equivalent value). A crafted campaign name could execute arbitrary JavaScript when an admin opened the delete dialog.
• Denial of service: launching a campaign where every recipient ends up filtered out (e.g. after deleting a group mid-flight) queued an empty batch to the mail worker, which then panicked on an out-of-range index. Since this ran in a goroutine without recover(), it took down the entire Gophish process, not just that request.
• allowed_internal_hosts over-blocking: configuring even a single entry in allowed_internal_hosts caused all external traffic to be denied instead of just internal ranges - both IPv6 (::/0 was in the deny list, i.e. all of IPv6) and, less obviously, IPv4 too (::ffff:0:0/96 matches every IPv4 address once Go represents it internally in 16-byte form, not just literal IPv4-mapped IPv6 addresses). In practice this meant configuring the allowlist could silently break all outbound mail delivery.
• Authorization bypass: a locked-out user (account_locked or password_change_required set by an admin) could use their own still-valid API key to clear either flag on their own account via PUT /api/users/{id}, fully undoing the admin's action. The web login path already enforced this correctly; the API key path did not check it at all.

Dependency & toolchain modernization

• Go requirement raised from 1.13 to 1.25; CI now tests against the two currently-supported Go versions (1.25/1.26) instead of three end-of-life ones.
• Migrated off github.com/jinzhu/gorm (gorm v1, unmaintained since ~2020) to gorm.io/gorm (v2).
• Replaced bitbucket.org/liamstask/goose (unmaintained since 2015) with the actively maintained pressly/goose.
• All other dependencies updated to current versions. govulncheck findings went from 47 reachable vulnerabilities down to 1 (a gorilla/csrf TrustedOrigins issue with no upstream fix yet available - not exploitable here since trusted_origins ships empty by default).
• Rebuilt the frontend build pipeline: Gulp + Webpack (two build systems, 18 npm packages, silently overwriting each other's output for three files) replaced with a single esbuild script. npm run build is now a real, documented command - previously there was none at all.
• GitHub Actions updated off versions old enough to be flagged for the Node 20 runner deprecation.

New features

• Randomized send order: campaign targets are now shuffled before sending, instead of going out in group-insertion order (which was usually alphabetical and fully predictable).
• SMTP send-rate limiting: sending profiles now support an optional emails/second cap, to stay under an SMTP provider's rate limits.