CVE-2026-102603: Gotify: Insufficiently Protected Password Change endpoint
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Gotify serverto a version that resolves this vulnerability.Fixed in 3.0.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid client token associated with a user account. With that token, they can call the password-change endpoint and set a new password without knowing the current password or completing an elevated authentication step.
Which deployments are affected?
Gotify Server versions prior to 3.0.0 are affected. The issue concerns the POST /current/user/password endpoint when it accepts client-token authentication.
What is the impact if a client token is compromised?
The attacker can take control of password authentication for the token's associated user by setting a new password. Recovery may then require administrator intervention or direct database access.
What is the remediation?
Upgrade Gotify Server to version 3.0.0, which fixes the issue.