{"id":"CVE-2026-102603","kind":"vulnerability","aliases":["CVE-2026-102603","GHSA-3hcj-9m7p-wwm9","GO-2026-6772"],"related":[],"title":"Gotify: Insufficiently Protected Password Change endpoint in github.com/gotify/server","description":"Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.","summary":"Gotify server, a self-hosted push-message server, lets anyone holding a client token change the account password without knowing the current password. An attacker with a stolen client token can take over the user's password login.","severity":"medium","cvss":5.3,"epss":0.00335,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/gotify/server","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/gotify/server/v2","fixed":[],"affected":"all versions","ecosystem":"go"},{"name":"github.com/gotify/server/v3","fixed":["3.0.0"],"affected":"< 3.0.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","gotify","package","self-hosted"],"not_affected_if":["gotify-below-not-used","managed-hosting"],"how_to_check":"Check the Gotify server version (the module github.com/gotify/server/v3 below 3.0.0 is affected); the sources do not give a command for the running binary.","fix":"Upgrade github.com/gotify/server/v3 to 3.0.0 or later.\nRotate client tokens and reset user passwords if a token may have leaked before the upgrade.","status":"open","published_at":"2026-10-13T15:17:30+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T20:03:10+00:00","updated_at":"2026-10-23T20:03:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:03:10Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/gotify/server/v3 to 3.0.0 or later.\nRotate client tokens and reset user passwords if a token may have leaked before the upgrade.","summary":"Gotify server, a self-hosted push-message server, lets anyone holding a client token change the account password without knowing the current password. An attacker with a stolen client token can take over the user's password login.","category":"package","who_cares":["gotify","go","self-hosted"],"confidence":0.7,"analyst_note":"","how_to_check":"Check the Gotify server version (the module github.com/gotify/server/v3 below 3.0.0 is affected); the sources do not give a command for the running binary.\nUnknown whether the /current/user/password endpoint can be probed safely from outside.","needs_analyst":false,"not_affected_if":["managed-hosting","gotify-below-not-used"],"severity_if_unknown":"medium"},"cost_usd":0.000381,"input_tokens":2241,"output_tokens":313,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-102603':13A,24A '-2026':12A,20A,23A '-6772':21A '/current/user/password':105C '/gotify/server':10A,27A '/gotify/server/v2':30A '/gotify/server/v3':33A '3.0.0':99C,161C '3hcj':16A '9m7p':17A 'accept':106C 'access':154C 'account':58B,114C,146C 'administr':150C 'anoth':119C 'anyon':51B 'associ':137C 'attack':66B,124C 'authent':121C,143C 'chang':5A,56B,102C 'client':54B,70B,109C,128C 'control':140C 'current':63B,116C 'cve':11A,22A 'databas':153C 'direct':152C 'elev':120C 'endpoint':6A,103C 'fix':158C 'forc':145C 'ghsa':15A 'ghsa-3hcj-9m7p-wwm9':14A 'github.com':9A,26A,29A,32A 'github.com/gotify/server':8A,25A 'github.com/gotify/server/v2':28A 'github.com/gotify/server/v3':31A 'go':19A,34B 'gotifi':1A,35B,40B,80C 'hold':52B 'host':39B,45B 'insuffici':2A 'issu':156C 'know':61B 'let':50B 'login':79B 'messag':48B,90C 'new':133C 'obtain':126C 'packag':36B 'password':4A,59B,64B,78B,101C,117C,134C,142C 'per':95C 'post':104C 'prior':97C 'protect':3A 'push':47B 'push-messag':46B 'real':93C 'real-tim':92C 'receiv':89C 'recoveri':147C 'requir':112C 'self':38B,44B 'self-host':37B,43B 'send':87C 'server':41B,49B,81C,85C 'set':131C 'simpl':84C 'step':122C 'stolen':69B 'take':73B,139C 'time':94C 'token':55B,71B,110C,129C 'user':76B,138C 'valid':108C 'version':160C 'websocket':96C 'without':60B,111C 'wwm9':18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-13T15:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6772","url":"https://pkg.go.dev/vuln/GO-2026-6772","severity":null,"published_at":"2026-10-19T21:08:35+00:00","modified_at":"2026-10-19T21:08:35+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102603","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102603","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-102603","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102603","severity":null,"published_at":"2026-10-13T15:17:30+00:00","modified_at":"2026-10-16T16:00:33+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}