CVE-2026-102603

The Gotify server is vulnerable to an insufficiently protected password change endpoint (POST /current/user/password) in versions prior to 3.0.0 . The software fails to require the account's current password or an elevated authentication step, accepting only a valid client token. An attacker who ...