Semaphore UI flaw let attackers hijack accounts

Published September 3, 2026 CVE-2026-73292

Semaphore UI's password change page had no protection against forged requests. An attacker could trick a logged-in user, even an administrator, into visiting a malicious webpage that silently changed their password.

Severity
HighCVSS 3.1 · 8.3
Fix
Fixed in 0.0.0-20260707190631-c59c3dc9035bFix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260707190631-c59c3dc9035b
Weakness
CWE-352Cross-Site Request Forgery (CSRF)
Exploit likelihood
0.23% in 30 daysEPSS, higher than 14% of known flaws
Affects
Semaphore UI

How it works

The password change page accepted requests from any website the logged-in user happened to visit, without a security token or a request for the current password, so a hidden form on an attacker's page could submit a new password using the victim's existing login session.

What to do

Check the Semaphore UI version shown in its admin interface or container image tag and compare it to 2.18.21.

Update Semaphore UI to version 2.18.21 or later, where the password change endpoint now requires a CSRF token and confirmation of the current password.

Technical details

The /api/users/{id}/password endpoint relied only on the semaphore session cookie for authentication, with no CSRF token, no SameSite cookie restriction, and no current-password confirmation (CWE-352, CWE-620). This let a cross-site request forgery attack change any user's password, including an administrator's, purely through victim interaction with a malicious page. Fixed in 0.0.0-20260707190631-c59c3dc9035b (release 2.18.21), which adds CSRF protection and password confirmation to the endpoint.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction Required Requires another user to take an action
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact Low Reduced performance or interruptions
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L Open in FIRST.org calculator

References

View Original Source