Basecamp Upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers, removing the verification of authenticity tokens that Rails normally enforces. The resulting flaw, identified as CWE‑352, allows a forged request sent from a logged‑in user’s browser to be forwarded to upstream services, enabling write or management actions such as creating an Alertmanager silence or triggering a Prometheus reload without authenticating to those services.

The vulnerability is present in the Basecamp Upright application, targeting the alertmanager_proxy_controller and prometheus_proxy_controller. No explicit vendor product or version list is provided; the issue exists in the commit identified by efe4f2e5254ac6e57e45d2261804cca74dbbca3f. Applications that run this commit and provide access to Alertmanager or Prometheus endpoints that accept write operations are vulnerable.

The CVSS score of 5.4 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, so the exploit probability is not formally quantified. The attack requires a user to be authenticated to Upright, after which the attacker can force the user’s browser to submit cross‑site requests that are forwarded to upstream services offering write or management APIs. The risk is increased when those upstream endpoints are enabled and reachable from the Upright host.