The Gotify server’s password change endpoint allows a client that holds any valid client token to change the associated user’s password without proving knowledge of the current password or any other higher‑level authentication step. This flaw, classified as CWE‑620, effectively lets an attacker take over the authenticated user’s account. Once the password is changed, the attacker can authenticate as that user or force a recovery‑by‑admin or database‑level process to regain control of the account, compromising confidentiality and integrity of account credentials.

Gotify server versions prior to 3.0.0 are affected, specifically the POST /current/user/password endpoint in the server product from the Gotify vendor. The issue is resolved in version 3.0.0 and later.

The CVSS score of 5.3 indicates a medium severity vulnerability. No EPSS score is available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The typical attack vector involves an attacker who has obtained or intercepted a client token—such as through legitimate client activity or a token‑leak scenario—making the exploit straightforward once a token is in hand. Without elevated privileges or additional authentication, the attacker can change the password and gain full control of the user’s account.