Back
Vendor security profile

Basecamp

5 known vulnerabilities · CVSS, KEV, timeline & products

5Total CVEs
6.0Avg CVSS
0Critical 0In CISA KEV
CVEs over time

Click a year for its months, then a month to list its CVEs.

Severity distribution
Critical 0 High 1 Medium 0 Low 0 Unscored 4

Unscored (80%): no CVSS from NVD yet, not a sign the CVE is harmless.

Top products
BASECAMP 1

Latest CVEs for Basecamp

8.8CVSS
CVE-2026-67993 · Sep 29, 2026
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credentials callback.
DEFERRED
HIGH
5.4CVSS
CVE-2026-67990 · Aug 13, 2026
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests t…
DEFERRED
MEDIUM
4.2CVSS
CVE-2025-58067 · Aug 29, 2025
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "proceed_to" value in the session store is set to a protocol-relative URL. Normally the …
DEFERRED
MEDIUM
4.2CVSS
CVE-2025-57821 · Aug 27, 2025
Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same origin" check, resulting in the user being redirected to another origin. Rails applic…
DEFERRED
MEDIUM
7.5CVSS
CVE-2023-36612 · Jun 25, 2023
Directory traversal can occur in the Basecamp com.basecamp.bc3 application before 4.2.1 for Android, which may allow an attacker to write arbitrary files in the application's private directory. Additionally, by using a malicious intent, the…
PoC availableBASECAMPMODIFIED
HIGH