Cross-Site Request Forgery Flaw in Semaphore UI Affects User Password Security

CVE-2026-73292

What is CVE-2026-73292?

The Semaphore UI application has a vulnerability that allows an unauthenticated attacker to change user passwords by exploiting the /api/users/{id}/password endpoint. This endpoint fails to implement cross-site request forgery (CSRF) protection and lacks current-password verification, making it susceptible to attacks using an authenticated user's session cookie. As a result, attackers can potentially alter an administrator's password or any other users’ passwords following user interaction, exposing sensitive accounts to unauthorized access. This flaw has been addressed in Semaphore UI version 2.18.21.

References