CSRF Vulnerability in Basecamp's Upright Product
CVE-2026-67990

5.4MEDIUM

Key Information:

Vendor

Basecamp

Status
Upright
Vendor
CVE Published:
13 August 2026

What is CVE-2026-67990?

The Basecamp Upright product has a vulnerability that disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. This oversight allows an unauthenticated attacker to craft requests that a logged-in user's browser may inadvertently submit. These requests can target upstream services, potentially leading to unauthorized actions such as creating silences in Alertmanager or triggering reloads in Prometheus. The specific impact of the attack depends on the APIs that are exposed and enabled by these upstream services.

References

https://github.com/basecamp/upright
https://github.com/basecamp/upright/blob/efe4f2e5254ac6e5...
https://github.com/basecamp/upright/blob/efe4f2e5254ac6e5...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.