CVE-2026-73292
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Semaphore UI before version 2.18.21 has a CSRF vulnerability in the /api/users/{id}/password endpoint, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. No CSRF protection or current-password confirmation is present.
Risk Assessment
Risk of account takeover of an administrator or other user, potentially leading to unauthorized access to DevOps infrastructure management.
Recommendation
Upgrade Semaphore UI to version 2.18.21 or later, which includes the fix.
Original NVD description (English source)
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.