CVE-2026-102603
Description
A flaw was found in Gotify server. The password change endpoint accepts a standard client authentication token without requiring the account's current password or an elevated re-authentication check. A remote attacker who obtains a valid client token can exploit this flaw to change the associated user's password, leading to account takeover.
Statement
A moderate-impact flaw was found in Gotify server, an upstream third-party messaging server that is not shipped in any Red Hat product offering. The password change endpoint (POST /current/user/password) accepts a standard client authentication token without requiring the account's current password or an elevated re-authentication check. A remote attacker who has obtained a valid client token for a user can therefore set a new password for that account, taking over password authentication and locking out the legitimate user, whose access can only be restored through an administrator or direct database access. Red Hat rates this flaw as Moderate (CVSS 6.3, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L), which is consistent with the upstream CVEORG rating of Moderate. Because Gotify server is not distributed by Red Hat, no Red Hat products are affected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream project has fixed this issue in Gotify server 3.0.0; users of affected versions should upgrade to the fixed upstream release.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
This could be used by an attacker to change passwords for another user, thus gaining the privileges associated with that user.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
