CVE-2026-91994
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
نوع الضعف
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
المراجع
- https://github.com/semaphoreui/semaphore
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329
- https://github.com/semaphoreui/semaphore/issues/4150
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests
اكتشف الثغرة قبل أن يكتشفها المهاجم.
سجّل الدخول عبر GitHub وشغّل أول تدقيق لك في أقل من دقيقة. الخطة المجانية لا تتطلب بطاقة ائتمان.