CVE-2026-102603

5.3Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-620

Impact

An attacker with a leaked client token can hijack the associated user account by setting a new password. They only need network access and an existing client token, with no knowledge of the current password.

Root cause

The password change endpoint (/current/user/password) authenticates requests using only a client token without validating the current password.

Affected systems

Gotify server prior to 3.0.0

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade Gotify server to version 3.0.0 or later. If upgrading must wait, block external access to the POST /current/user/password endpoint at your reverse proxy or revoke compromised client tokens immediately.

shell

$ docker pull gotify/server:3.0.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102603