{"id":"GO-2026-6772","revision":"1bcbe5ab6f544a85bdfb6608a600c14d","records":[{"revision":"1bcbe5ab6f544a85bdfb6608a600c14d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6772","aliases":["CVE-2026-102603","GHSA-3hcj-9m7p-wwm9"],"title":"Gotify: Insufficiently Protected Password Change endpoint in github.com/gotify/server","description":"Gotify: Insufficiently Protected Password Change endpoint in github.com/gotify/server","state":0,"publishedAt":"2026-10-19T21:08:35+00:00","modifiedAt":"2026-10-19T21:31:37.9019579+00:00","affected":[{"ecosystem":"Go","name":"github.com/gotify/server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gotify/server/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gotify/server/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9","https://nvd.nist.gov/vuln/detail/CVE-2026-102603","https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9","https://github.com/gotify/server/pull/952","https://github.com/gotify/server/releases/tag/v3.0.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6772","license":"OSV · upstream source license applies","key":"osv:GO-2026-6772","identifiers":["GO-2026-6772","CVE-2026-102603","GHSA-3hcj-9m7p-wwm9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}