CVE-2026-91994
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Weakness
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
References
- https://github.com/semaphoreui/semaphore
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329
- https://github.com/semaphoreui/semaphore/issues/4150
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.