Semaphore UI (< 0.0.0-20260707190631-C59c3dc9035b) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/semaphore-ui--0.0.0-20260707190631-c59c3dc9035b/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 00:07:25 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSemaphore UI Cross-Site Request Forgery Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/Fri, 04 Sep 2026 00:07:25 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/Semaphore UI is vulnerable to a CSRF attack via the password change endpoint, enabling unauthenticated attackers to hijack user accounts, including administrator accounts, by inducing an authenticated user to visit a malicious webpage.Semaphore UI, an open-source automation platform, contains a critical Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-73292) identified in versions prior to 0.0.0-20260707190631-c59c3dc9035b. The vulnerability stems from the password change endpoint (/api/users/<id>/password) failing to enforce CSRF tokens or require re-authentication via a current password. Additionally, session cookies lack 'SameSite' attribute enforcement, facilitating cross-origin request abuse. By tricking an authenticated user into visiting a crafted malicious page, an attacker can silently execute a password change request. This allows for full account takeover, including the administrative account, depending on the targeted user's privileges. Defenders should prioritize patching, as this vulnerability requires minimal user interaction and leads to complete platform compromise.

Impact

Successful exploitation results in the takeover of the targeted user's account. Because this vulnerability allows an attacker to change the administrator's password, it can lead to full administrative compromise of the Semaphore UI instance, enabling an attacker to manipulate projects, run arbitrary automation tasks, and potentially escalate access within the organization's infrastructure.

Recommendation

  1. Upgrade Semaphore UI to the latest patched version (>= 0.0.0-20260707190631-c59c3dc9035b) immediately to remediate CVE-2026-73292.
  2. Implement global 'SameSite=Strict' or 'SameSite=Lax' cookie policies via load balancers or WAFs if immediate patching is not feasible.
  3. Review audit logs for suspicious password change events occurring from unexpected IP addresses or anomalous User-Agent strings.
]]>mediumadvisoryweb-vulnerabilitycsrfaccount-takeover