Semaphore UI CVE-2026-73292

Exploitation requires that the victim hold an active authenticated Semaphore session in their browser at the time of the attack - the CVSS UI:R component reflects this mandatory user-interaction prerequisite. The attacker must also know or enumerate the Semaphore instance's URL and the numeric user ID of the target account; the default administrator account ID is typically 1 and is likely enumerable via other API endpoints. Exploitation is limited to Semaphore versions prior to 2.18.21 where the session cookie lacks SameSite=Lax. Instances deployed exclusively on private networks with no path from untrusted origins are effectively protected, as a browser on a separate network cannot reach the Semaphore host to complete the forged request. Non-HTTPS deployments face the additional risk that cookies can be intercepted at the network layer, but HTTPS is not a prerequisite for CSRF exploitation itself.

The CVSS 8.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) accurately models the attack: no attacker-side privileges, low complexity, but mandatory victim interaction. EPSS data is absent from the provided intelligence, limiting probabilistic exploitation forecasting. The absence from CISA KEV and the lack of any referenced POC code suggest exploitation has not been observed at scale, though the technique is well-understood and requires no specialized tooling. Real-world risk is materially elevated wherever Semaphore is reachable from the public internet or wherever administrators routinely browse untrusted web content while logged into the platform - even a mid-sized municipal IT team in radom should treat this as urgent if their Semaphore instance is publicly exposed. Account takeover of an administrator session carries cascading consequences beyond the base score: full control over automation playbooks, stored credentials, and all infrastructure managed through Semaphore. The A:L (low availability) metric captures only immediate victim lockout; downstream infrastructure impact from attacker-controlled playbook execution is not reflected in the base CVSS score.

An attacker crafts a webpage containing a hidden HTML form or JavaScript fetch that POSTs a new password value to https://[semaphore-host]/api/users/1/password. The attacker delivers a link to this page via phishing to a Semaphore administrator. When the administrator clicks the link while their browser holds an active Semaphore session, the browser automatically attaches the session cookie to the cross-site POST, and Semaphore updates the administrator's password without any additional verification, allowing the attacker to log in with the newly set credentials and take full administrative control.