Skip to content
OpenAdvisories

Vendor

semaphoreui

5 known vulnerabilities.

Products

semaphore 4 Semaphore UI 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.3
    CVE-2026-73292 Public exploit

    Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

    Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, a…

    semaphoreui semaphore github.com/semaphoreui/semaphore Go