CVE-2026-73292CWE-352CWE-620csrf

CVE-2026-73292

High · published August 12, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
13.2
In the wild
Unconfirmed
What it is

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00232 · 13.2th percentile
Weaknesses
CWE-352 · Cross-Site Request Forgery (CSRF); CWE-620 · Unverified Password Change
Published
2026-08-12T20:17Z
References (4)
https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c · [email protected]https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956 · [email protected]https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21 · [email protected]https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945 · [email protected]
EPSS history
Timeline
  • 12 AUG 15:34Z
    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
    cvelistv5