GHSA-3HCJ-9M7P-WWM9 Gotify: Insufficiently Protected Password Change endpoint

The password change endpoint POST /current/user/password in Gotify versions = 2.9.1 does not require knowledge of the current password. An attacker in possession of a valid client token can set a new password for the affected user. Recovering the account requires administrator intervention or...