Login Cross-Site Request Forgery Vulnerability in Basecamp's Upright Product
CVE-2026-67993

8.8HIGH

Key Information:

Vendor

Basecamp

Status
Upright
Vendor
CVE Published:
29 September 2026

What is CVE-2026-67993?

The Upright product by Basecamp has a vulnerability that allows for a cross-site request forgery, specifically in the login functionality. This issue can be exploited through a static credentials callback, potentially enabling unauthorized actions on behalf of a legitimate user. It's crucial for users of this product to implement security measures to prevent CSRF attacks that could compromise account integrity and sensitive information. For more details and remediation steps, refer to the official GitHub repository and the specific commit documentation.

References

https://github.com/basecamp/upright
https://github.com/basecamp/upright/blob/efe4f2e5254ac6e5...

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.