CVE-2026-67990 describes a security vulnerability in the basecamp/upright project at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f, where Rails CSRF protection is disabled for Alertmanager and Prometheus proxy controllers. This enables an attacker without authentication to induce a logged-in user's browser to send requests that are forwarded to upstream services with write or management capabilities. The actual impact varies depending on which upstream APIs are enabled, potentially allowing unauthorized configuration changes or management actions on Alertmanager or Prometheus.

An unauthenticated attacker can leverage a logged-in user's browser to perform unauthorized actions on upstream services such as Alertmanager and Prometheus. This may include creating silences in Alertmanager or reloading Prometheus configurations, depending on the enabled APIs. The vulnerability could lead to unauthorized modification of monitoring or alerting configurations, potentially disrupting monitoring operations or hiding alerts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to the affected proxy controllers or upstream management endpoints, and monitor for suspicious activity. Avoid exposing these endpoints to untrusted networks and ensure users are aware of potential CSRF risks.