basecamp/upright disables CSRF protection for two proxy controllers, allowing a user’s browser to unknowingly submit requests to downstream services. An attacker can force a logged‑in user to trigger writes such as creating an Alertmanager silence or reloading Prometheus. The resulting impact is the attacker’s ability to balance the configuration or silence alerts without direct authentication, potentially leading to denial of service or inadvertent operational changes.

The vulnerability resides in the Basecamp Upright application, specifically in the alertmanager_proxy_controller and prometheus_proxy_controller. No official vendor product or version list is provided; the affected code is the commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f.

No EPSS score and it is not listed in CISA KEV. The CVSS score is not supplied, so explicit severity cannot be determined from the input. Because CSRF protection is disabled, the flaw is exploitable as long as a user has a session with an authenticated connection to Upright and the upstream service permits the operations being requested. The risk is higher when the upstream endpoints are enabled and accessible.