Basecamp CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Basecamp CVE published 2026-08-13

CVE-2026-67990

An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. This vulnerability affects the basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, which disables Rails CSRF protection for its Alertmanager and Prometheus prox [truncated]