CVE-2026-67993

HighCVSS 8.8

Published: 29/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

3th percentile - higher than 3% of all known CVEs

Summary

The basecamp/upright project at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.

Risk Assessment

An attacker can exploit CSRF to log in on behalf of a victim, potentially leading to session hijacking or unauthorized actions.

Recommendation

Update the component to a patched version or implement CSRF protections such as anti-CSRF tokens in the login flow.

Other vulnerabilities in basecamp/upright

CVE-2026-67990Medium
In basecamp/upright at a specific commit, Rails CSRF protection is disabled for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.

Original NVD description (English source)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS