Basecamp: Cross-account stored XSS on app.basecamp.com leads to persistent administrator takeover

A cross-account stored cross-site scripting vulnerability was discovered in a project collaboration application. An outside collaborator could store a message containing malicious HTML within an attachment content attribute that appeared as a normal embed when viewed. When an account administrato...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-67993: Cross-Site Request Forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-67993

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

CVE-2026-67993

The basecamp/upright software, specifically at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f , is vulnerable to a login cross-site request forgery (CSRF) issue. This vulnerability exists within the static credentials callback . While the impact is categorized as high severity (CVSS 8.8) involvi...

PT-2026-102900

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

EUVD-2026-89426

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback...

Basecamp: Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses

A vulnerability was discovered in HEY's email service that allowed ordinary users to send authenticated emails from arbitrary HEY addresses without authorization. An attacker could create a temporary external account claiming any target HEY address using unrelated SMTP credentials, enqueue a...

Basecamp: A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_option

A third-party OAuth token was able to mint a full web session through an API endpoint, allowing an integration to obtain unauthorized session access and modify account settings. The vulnerability has been patched to only accept authorized session tokens...

Basecamp: Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonce

A cross-account cross-site scripting vulnerability was discovered on an embed display page. The page rendered HTML returned by embed providers without proper host validation. The security check compared registrable domains incorrectly, allowing requests from application hosts that should have bee...

Basecamp: Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhook

A cross-account webhook takeover vulnerability was identified in Basecamp's webhook API endpoints. The PUT and DELETE operations on webhook resources were authorizing based on project visibility rather than account membership. This allowed an attacker from one account to modify and delete webhook...

Basecamp: Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow

A case-sensitive URL scheme comparison flaw in the proxy image endpoint allowed open redirects on the mail service's web domain. The endpoint failed to recognize uppercase HTTPS scheme variants and redirected users to unproxied URLs instead of properly proxying them. When combined with the deskto...

Basecamp: Launchpad file read leaks production keys

A file-read vulnerability in a platform exposed production storage credentials. The vulnerable processing path was fixed, exposed credentials were rotated, and the old key was deleted...

Basecamp: launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp API

A custom OAuth2 authorization server was found to issue victim-bound API credentials to unverified attacker-controlled redirect URIs. The authorization server accepted client registrations with self-chosen redirect URIs without performing ownership verification, ownership approval, or URI structu...

Basecamp: One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML

A cross-account JavaScript execution vulnerability was discovered in a web application that allowed arbitrary code execution when a victim opened a crafted public board URL. An attacker with a separate account could leverage this vulnerability to steal the victim's write access token through a...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990: Cross-Site Request Forgery (CSRF)

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...

CVE-2026-67990

basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management...