Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:LSummary
CVE-2026-73292 is a high-severity CSRF (CWE-352) vulnerability. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Account Manipulation (T1098); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-11 (Re-authentication) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-57311
Vulnerability Data
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an…
more
administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.3.2V3.5.1V10.2.1
Mitigating Controls (NIST 800-53 r5) AI
Re-authentication explicitly requires users to prove identity before performing sensitive actions such as password changes.
Authenticator management requires identity verification during password distribution and changes, directly stopping unverified password updates.
Access enforcement requires verifying that state-changing requests originate from the authenticated user rather than a forged cross-site source.
Protecting session authenticity prevents attackers from replaying or forging authenticated requests via the victim's browser.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Credential management practices directly enforce re-authentication for password changes.
Authentication requirements include verifying identity before allowing credential modifications.
Secure SDLC practices directly require anti-CSRF controls such as tokens or SameSite attributes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Requires secure management of authentication information, directly addressing the need to verify the original password before allowing a change.
By denying access to phishing or malicious sites, the control lowers the likelihood that a user will be tricked into submitting a forged request that performs an unintended action on another site.
Mandates secure authentication mechanisms, which include verifying existing credentials before permitting password changes.
Identity management processes can incorporate verification steps, but the control itself does not explicitly require password-change verification.
Contextual intelligence about emerging CSRF toolkits can be translated into updated anti-CSRF token or same-site policy configurations across applications.
Information access restriction can be strengthened by password verification, yet the control focuses on access rights rather than change procedures.