Description

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-12T16:17:22.343Z",
  "pubdate": "2026-08-12T16:17:22.343Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in Semaphore UI prior to version 2.18.21.\nThe vulnerability resides within the password management functionality, specifically affecting the /api/users/{id}/password endpoint.\nThis flaw allows an unauthenticated remote attacker to force an authenticated user, including administrators, to modify their account password without their consent.\nExploitation requires user interaction, typically achieved by tricking a victim into visiting a malicious webpage or clicking a crafted link while maintaining an active session in Semaphore UI.\nThe absence of anti-CSRF tokens and the omission of current-password confirmation mechanisms permit malicious cross-origin requests to succeed using the victim's valid session cookie.\nSuccessful exploitation leads to a complete account takeover, enabling unauthorized administrative access and full compromise of the DevOps management interface and associated infrastructure.",
  "technicalDetails": "The root cause of this vulnerability is the lack of Cross-Site Request Forgery (CSRF) protection and the absence of a current-password verification requirement on the password update endpoint.\nThe vulnerable component is the REST API endpoint located at /api/users/{id}/password.\nAffected products include Semaphore UI versions prior to 2.18.21.\nAuthentication requirements involve the victim having an active authenticated session via a session cookie, while the attacker themselves requires no authentication.\nPrivilege requirements are asymmetric; although the attacker is unauthenticated, the victim whose session is hijacked can possess administrative privileges, granting the attacker elevated control post-exploitation.\nNetwork exposure is inherent to any web-accessible deployment of Semaphore UI.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious HTML page or script designed to issue an unauthorized HTTP request to the target Semaphore UI instance.\nSecond, the attacker deploys social engineering tactics to induce the victim—who is currently logged into Semaphore UI—to access the malicious resource.\nThird, the victim's browser automatically attaches the valid session cookie to the cross-origin request targeting /api/users/{id}/password due to standard browser cookie inclusion behavior.\nFourth, the backend application processes the incoming HTTP request, accepting the supplied new password payload without validating the origin of the request or prompting for the user's existing password.\nFinally, the target user's password is successfully updated to the attacker-controlled value, effectively locking out the legitimate user and allowing the attacker to hijack the session and assume full administrative control of the application."
}