{"id":"EUVD-2026-98753","enisaUuid":"3a9e3ba4-8645-36be-bb11-196cd98b5185","description":"Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account\u0027s current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.","datePublished":"Oct 13, 2026, 2:21:20 PM","dateUpdated":"Oct 14, 2026, 2:45:36 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9\nhttps://github.com/gotify/server/pull/952\nhttps://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9\nhttps://github.com/gotify/server/releases/tag/v3.0.0\n","aliases":"CVE-2026-102603\nGHSA-3hcj-9m7p-wwm9\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"7272a8bd-24a0-39f7-8503-8520579bb556","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 3.0.0"}],"enisaIdVendor":[{"id":"2f900366-448a-3bf0-8d13-2edcc1090b19","vendor":{"name":"gotify"}}],"enisaIdVulnerability":[{"id":"796496fe-fc87-39d4-94b6-c41150c810d7","vulnerability":{"id":"CVE-2026-102603","description":"Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account\u0027s current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.","datePublished":"Oct 13, 2026, 2:21:20 PM","dateUpdated":"Oct 14, 2026, 2:45:36 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9\nhttps://github.com/gotify/server/pull/952\nhttps://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9\nhttps://github.com/gotify/server/releases/tag/v3.0.0\n","enisa_id":"EUVD-2026-98753\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Oct 29, 2026, 7:15:08 AM","vulnerabilityProduct":[{"id":"86e274e5-2c99-3a4d-a2d7-ca3e85aa6f60","product":{"name":"Server","vendor":{"name":"Devolutions"}},"product_version":"\u003c 3.0.0"}],"vulnerabilityVendor":[{"id":"75c4d7f7-5277-3a2c-a982-6b7d522ead96","vendor":{"name":"gotify"}}]}},{"id":"9c090bd0-67bd-393f-94f8-00e7dda6686b","vulnerability":{"id":"GHSA-3hcj-9m7p-wwm9","description":"Gotify: Insufficiently Protected Password Change endpoint","datePublished":"Oct 15, 2026, 8:15:38 PM","dateUpdated":"Oct 15, 2026, 8:15:38 PM","baseScore":0.0,"references":"https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-102603\nhttps://github.com/gotify/server/pull/952\nhttps://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9\nhttps://github.com/gotify/server\nhttps://github.com/gotify/server/releases/tag/v3.0.0\n","enisa_id":"EUVD-2026-98753\n","aliases":"GHSA-3hcj-9m7p-wwm9\nCVE-2026-102603\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:03:05 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}