Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
4 vulnerabilities by gotify
CVE-2026-102603 (GCVE-0-2026-102603)
Vulnerability from nvd – Published: 2026-10-13 14:21 – Updated: 2026-10-14 14:45
VLAI
EPSS
VEX
Title
Gotify: Insufficiently Protected Password Change endpoint
Summary
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:43 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gotify/server/security/advisor… | x_refsource_CONFIRM |
| https://github.com/gotify/server/pull/952 | x_refsource_MISC |
| https://github.com/gotify/server/commit/a8744482c… | x_refsource_MISC |
| https://github.com/gotify/server/releases/tag/v3.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:43:27.030912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:45:36.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "gotify",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account\u0027s current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:21:20.867Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
},
{
"name": "https://github.com/gotify/server/pull/952",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/952"
},
{
"name": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9"
},
{
"name": "https://github.com/gotify/server/releases/tag/v3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/releases/tag/v3.0.0"
}
],
"source": {
"advisory": "GHSA-3hcj-9m7p-wwm9",
"discovery": "UNKNOWN"
},
"title": "Gotify: Insufficiently Protected Password Change endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102603",
"datePublished": "2026-10-13T14:21:20.867Z",
"dateReserved": "2026-09-29T14:18:02.920Z",
"dateUpdated": "2026-10-14T14:45:36.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-46181 (GCVE-0-2022-46181)
Vulnerability from nvd – Published: 2022-12-29 18:36 – Updated: 2025-04-10 18:02
VLAI
EPSS
VEX
Title
Gotify server XSS vulnerability in the application image file upload
Summary
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-10 18:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/gotify/server/security/advisor… | x_refsource_CONFIRM |
| https://github.com/gotify/server/pull/534 | x_refsource_MISC |
| https://github.com/gotify/server/pull/535 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:31:44.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh"
},
{
"name": "https://github.com/gotify/server/pull/534",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gotify/server/pull/534"
},
{
"name": "https://github.com/gotify/server/pull/535",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gotify/server/pull/535"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-10T18:02:01.051299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T18:02:15.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "gotify",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won\u0027t natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-29T18:36:46.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh"
},
{
"name": "https://github.com/gotify/server/pull/534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/534"
},
{
"name": "https://github.com/gotify/server/pull/535",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/535"
}
],
"source": {
"advisory": "GHSA-xv6x-456v-24xh",
"discovery": "UNKNOWN"
},
"title": "Gotify server XSS vulnerability in the application image file upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-46181",
"datePublished": "2022-12-29T18:36:46.603Z",
"dateReserved": "2022-11-28T17:27:19.999Z",
"dateUpdated": "2025-04-10T18:02:15.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-102603 (GCVE-0-2026-102603)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:21 – Updated: 2026-10-14 14:45
VLAI
EPSS
VEX
Title
Gotify: Insufficiently Protected Password Change endpoint
Summary
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:43 UTC
CWE
- CWE-620 - Unverified Password Change
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/gotify/server/security/advisor… | x_refsource_CONFIRM |
| https://github.com/gotify/server/pull/952 | x_refsource_MISC |
| https://github.com/gotify/server/commit/a8744482c… | x_refsource_MISC |
| https://github.com/gotify/server/releases/tag/v3.0.0 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102603",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:43:27.030912Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T14:45:36.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "gotify",
"versions": [
{
"status": "affected",
"version": "\u003c 3.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account\u0027s current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-620",
"description": "CWE-620: Unverified Password Change",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:21:20.867Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-3hcj-9m7p-wwm9"
},
{
"name": "https://github.com/gotify/server/pull/952",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/952"
},
{
"name": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/commit/a8744482c668e07a61798573ec8e17bd3f6009f9"
},
{
"name": "https://github.com/gotify/server/releases/tag/v3.0.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/releases/tag/v3.0.0"
}
],
"source": {
"advisory": "GHSA-3hcj-9m7p-wwm9",
"discovery": "UNKNOWN"
},
"title": "Gotify: Insufficiently Protected Password Change endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-102603",
"datePublished": "2026-10-13T14:21:20.867Z",
"dateReserved": "2026-09-29T14:18:02.920Z",
"dateUpdated": "2026-10-14T14:45:36.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-46181 (GCVE-0-2022-46181)
Vulnerability from cvelistv5 – Published: 2022-12-29 18:36 – Updated: 2025-04-10 18:02
VLAI
EPSS
VEX
Title
Gotify server XSS vulnerability in the application image file upload
Summary
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-10 18:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/gotify/server/security/advisor… | x_refsource_CONFIRM |
| https://github.com/gotify/server/pull/534 | x_refsource_MISC |
| https://github.com/gotify/server/pull/535 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T14:31:44.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh"
},
{
"name": "https://github.com/gotify/server/pull/534",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gotify/server/pull/534"
},
{
"name": "https://github.com/gotify/server/pull/535",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/gotify/server/pull/535"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-46181",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-10T18:02:01.051299Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-10T18:02:15.686Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "server",
"vendor": "gotify",
"versions": [
{
"status": "affected",
"version": "\u003c 2.2.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** another user opened a link. The attacker could potentially take over the account of the user that clicked the link. The Gotify UI won\u0027t natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify. The vulnerability has been fixed in version 2.2.2. As a workaround, you can block access to non image files via a reverse proxy in the `./image` directory."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-12-29T18:36:46.603Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/gotify/server/security/advisories/GHSA-xv6x-456v-24xh"
},
{
"name": "https://github.com/gotify/server/pull/534",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/534"
},
{
"name": "https://github.com/gotify/server/pull/535",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/gotify/server/pull/535"
}
],
"source": {
"advisory": "GHSA-xv6x-456v-24xh",
"discovery": "UNKNOWN"
},
"title": "Gotify server XSS vulnerability in the application image file upload"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-46181",
"datePublished": "2022-12-29T18:36:46.603Z",
"dateReserved": "2022-11-28T17:27:19.999Z",
"dateUpdated": "2025-04-10T18:02:15.686Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}