CVE-2026-102603Medium· 5.3▾ SunlitGotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's curre…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
— → 5.3
none → medium
Last analysed / modified upstream
Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access. This issue is fixed in version 3.0.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/gotify/server/v2 <= 2.9.1github.com/gotify/server/v3 < 3.0.0Patched in:
github.com/gotify/server/v3 3.0.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77167High· 7.5Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table
CVE-2026-77172Medium· 5.3App passwords were allowed to bypass password confirmation on sensitive endpoints.
CVE-2026-82984Medium· 4.3When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticate…
CVE-2026-114487NoneMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers …
CVE-2026-114486NoneIncorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach deni…
CVE-2026-114485NoneInsufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via th…