Basecamp Upright CVE-2026-67993

Exploitation targets the static-credentials login callback in Upright's SessionsController (sessions_controller.rb), which lacks CSRF protection on the login action. It requires victim user interaction (UI:R) - the victim must visit or be redirected to an attacker-controlled web page that issues the forged cross-site login request - and requires the application to actually expose Upright's static-credentials session flow. No authentication is needed by the attacker (PR:N), but the practical impact is bounded because login CSRF logs the victim into the ATTACKER's session rather than compromising the victim's own account, limiting realistic damage to data the victim then enters under the attacker's identity.

MITRE-assigned CVSS 3.1 is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), driven by a network vector, low complexity, no privileges, and full CIA impact. That impact rating is aggressive for the actual weakness: CWE-352 login CSRF in a static-credentials session callback typically forces a victim into the ATTACKER's authenticated session rather than compromising the victim's own confidentiality/integrity/availability, so C:H/I:H/A:H likely overstates real-world consequence - verify impact scope with the maintainer. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so this is no public exploit identified at time of analysis. The UI:R requirement (victim must be lured to an attacker-controlled page) and the niche footprint of the affected library further temper real urgency: this reads as a genuine but not high-priority defensive fix rather than an actively exploited threat. Affected-version data is effectively absent (EUVD lists only 'n/a n/a'); the vulnerability is pinned to a single git commit (efe4f2e), so consumers must map that commit to their vendored/gem version themselves.

An attacker hosts a malicious page containing an auto-submitting form (or hidden request) that POSTs to Upright's session/login endpoint using static credentials the attacker controls. A logged-out or logged-in victim who visits the page (UI:R) is silently authenticated into the attacker's account, after which any data the victim subsequently enters or actions they take occur in the attacker-controlled session. No public proof-of-concept is referenced in the available data.