CVE-2026-102603: Gotify: Insufficiently Protected Password Change endpoint

October 15, 2026

The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.

References

github.com/advisories/GHSA-3hcj-9m7p-wwm9
github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9
github.com/gotify/server/pull/952
github.com/gotify/server/releases/tag/v3.0.0
github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9
nvd.nist.gov/vuln/detail/CVE-2026-102603

Code Behaviors & Features

Detect and mitigate CVE-2026-102603 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →