Skip to content
OpenAdvisories

Package · Go

github.com/gotify/server

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-102603

    Gotify: Insufficiently Protected Password Change endpoint

    Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another…

    gotify server github.com/gotify/server/v2 github.com/gotify/server Go
  • Medium —
    GHSA-3244-8mff-w398

    Reflected XSS in Gotify's /docs via import of outdated Swagger UI

    ### Impact Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files. Specifically, the DOMPurif…

    github.com/gotify/server/v2 github.com/gotify/server Go
  • Medium 6.1
    CVE-2022-46181

    Gotify server XSS vulnerability in the application image file upload

    Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allows authenticated users to upload .html files. An attacker could execute client side scripts **if** an…

    gotify server github.com/gotify/server github.com/gotify/server/v2 Go