Vulnerabilities CVE-2026-73292

CVE-2026-73292

High

Open

TLP:CLEAR

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Details

CVSS Score: 8.3
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Confidence: 90%
Published: Aug 12, 2026
Last Modified: Aug 12, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.