CVE-2026-67990

Name of the Vulnerable Software and Affected Versions basecamp/upright versions prior to efe4f2e5254ac6e57e45d2261804cca74dbbca3f

Description The software disables Rails Cross-Site Request Forgery (CSRF) protection—a mechanism that prevents unauthorized commands from being transmitted from a user that the web application trusts—for its Alertmanager and Prometheus proxy controllers. This allows an unauthenticated attacker to trick the browser of a logged-in user into submitting requests that are forwarded to enabled upstream write or management endpoints. Potential impacts include the creation of an Alertmanager silence or triggering a Prometheus reload, depending on the APIs enabled by the upstream services.

Recommendations Update basecamp/upright to commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f.