CVE-2026-73292

Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.21

Description The application lacks Cross-Site Request Forgery (CSRF) protection—a type of attack that tricks a victim into submitting a malicious request—and does not require current-password confirmation at the '/api/users/{id}/password' endpoint. This allows an unauthenticated attacker to change the password of an administrator or another user following user interaction, leveraging the authenticated user's session cookie.

Recommendations Update to version 2.18.21.