Vulnerability · Published Oct 13, 2026 · Assigned by GitHub_M
CVE-2026-102603Gotify: Insufficiently Protected Password Change endpoint
Medium 5.3
In plain English
A medium-severity security flaw in server from gotify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/gotify/server | no fix listed | GO-2026-6772 |
| Go | github.com/gotify/server/v2 | no fix listed | GHSA-3hcj-9m7p-wwm9 |
| Go | github.com/gotify/server/v2 | no fix listed | GO-2026-6772 |
| Go | github.com/gotify/server/v3 | 3.0.0 | GHSA-3hcj-9m7p-wwm9 |
| Go | github.com/gotify/server/v3 | 3.0.0 | GO-2026-6772 |
Affected products (as reported)
Weakness: CWE-620 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
References
- https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9 x_refsource_CONFIRM
- https://github.com/gotify/server/pull/952 x_refsource_MISC
- https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9 x_refsource_MISC
- https://github.com/gotify/server/releases/tag/v3.0.0 x_refsource_MISC