Vendor
Semaphore UI is vulnerable to a CSRF attack via the password change endpoint, enabling unauthenticated attackers to hijack user accounts, including administrator accounts, by inducing an authenticated user to visit a malicious webpage.