Threat database

Gotify server versions prior to 3.0.0 have a vulnerability in the password change endpoint that allows an attacker with a valid client token to change a user's password without knowing the current password. This flaw requires administrator intervention or direct database access to recover the account. The issue is fixed in Gotify 3.0.0, which requires re-authentication with the current password to change it.