HIGHCVSS 8.3EPSS 0.2%

CVE-2026-73292

CVE-2026-73292 updated by NVD

Published: 2026-09-03
Modified: 2026-09-11
EPSS percentile: 14%
Sources: github-advisory, nvd

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/semaphoreui/semaphore	—	0.0.0-20260707190631-c59c3dc9035b

Remediation: Upgrade to 0.0.0-20260707190631-c59c3dc9035b or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73292

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.