Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

GoAnywhere MFT: Denial of Service via GOTP Email Two-Factor Authentication

CVE-2025-3871 · published 1 year ago
Summary

GoAnywhere MFT software versions prior to 7.8.1 have a security flaw that could be used to disable a legitimate user's account. This happens when two-factor authentication is set up to send one-time passwords by email, but the user hasn't set up their email address. To fix this issue, update to version 7.8.1 or later.

Original advisory text
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-facto...
Broken access control in Fortra's GoAnywhere MFT prior to 7.8.1 allows an attacker to create a denial of service situation when configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA) and the user has not set an email address. In this scenario, the attacker may enter the email address of a known user when prompted and the user will be disabled if that user has configured GOTP.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published16 Jul 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-3871 · NVD
Track software like this
Free during beta