CVE-2026-67990

The CVE-2026-67990 entry concerns basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, where Rails CSRF protection is disabled for the Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can trick a logged-in user’s browser into issuing requests that are for...