CVE-2026-91994Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Beschreibung

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Issue #4150 issue-trackingexploit
• GetMustCanMiddleware at v2.19.12 technical-description
• projectUserAPI environment routes at v2.19.12 technical-description
• https://github.com/semaphoreui/semaphore product
• VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests third-party-advisory