CVE-2026-91994
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Fraqueza
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Referências
- https://github.com/semaphoreui/semaphore
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106
- https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329
- https://github.com/semaphoreui/semaphore/issues/4150
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests
Encontre a falha antes de um atacante.
Entre com o GitHub e rode sua primeira auditoria em menos de um minuto. O plano gratuito não exige cartão de crédito.