EUVD-2026-57311Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Attacker needs no privileges; victim interaction mandatory; high confidentiality and integrity reflect full account takeover; low availability captures victim lockout only.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Lifecycle Timeline
4DescriptionCVE.org
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.
AnalysisAI
Password takeover in Semaphore UI prior to version 2.18.21 enables an unauthenticated attacker to reset any authenticated user's password - including administrator accounts - by luring them to a malicious page that silently issues a cross-site POST to /api/users/{id}/password. The session cookie was issued without SameSite restrictions, causing browsers to attach it automatically to cross-origin requests, and the endpoint performed no CSRF token validation or current-password confirmation before accepting the change. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim hold an active authenticated Semaphore session in their browser at the time of the attack - the CVSS UI:R component reflects this mandatory user-interaction prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 score (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) accurately models the attack: no attacker-side privileges, low complexity, but mandatory victim interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a webpage containing a hidden HTML form or JavaScript fetch that POSTs a new password value to https://[semaphore-host]/api/users/1/password. The attacker delivers a link to this page via phishing to a Semaphore administrator. … |
| Remediation | Upgrade Semaphore UI to version 2.18.21, available at https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21, which resolves the vulnerability by setting SameSite=Lax on session cookies and conditionally enforcing the Secure attribute when the instance is served over HTTPS. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all instances of Semaphore UI running versions prior to 2.18.21 and document the scope of exposure; consider restricting network access to Semaphore UI if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Argument (git option) injection in Semaphore UI before 2.18.17 and 2.19.5-beta2 lets a project Manager or Owner achieve
Remote code execution in Semaphore prior to version 2.18.20 allows authenticated project Managers and Owners to execute
Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by expl
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today