En bref
- CVE-2026-102603 est une vulnérabilité MOYENNE (CVSS 5.3) touchant github.com/gotify/server, github.com/gotify/server/v2, github.com/gotify/server/v3.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.34%, plus élevée que 27.1% des vulnérabilités.
- Correctif : mettre à jour vers 3.0.0 ou plus récent.
Description
The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.
PoC
# Attacker has obtained a client token
# No prior password knowledge required
STOLEN_TOKEN="Cxxxxxxxxxx"
curl -X POST "http://gotify-host/current/user/password?token=${STOLEN_TOKEN}" \
-H "Content-Type: application/json" \
-d '{"pass":"attacker_controls_this"}'
# Expected response:
# HTTP/1.1 200 OK
Mitigation
- Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or
- Restrict access to the state-changing endpoints under
/user and /current/user to trusted networks.
NVD description
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Autres vulnérabilités de github.com/gotify/server
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free