Live › vulnerability › CVE-2026-102603
Go to dashboardGotify server, a self-hosted push-message server, lets anyone holding a client token change the account password without knowing the current password. An attacker with a stolen client token can take over the user's password login.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| github.com/gotify/server | go | all versions | – |
| github.com/gotify/server/v2 | go | all versions | – |
| github.com/gotify/server/v3 | go | < 3.0.0 | 3.0.0 |
Check the Gotify server version (the module github.com/gotify/server/v3 below 3.0.0 is affected); the sources do not give a command for the running binary.
3.0.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-102603")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.