CVE-2026-91994Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Description

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Issue #4150 issue-trackingexploit
• GetMustCanMiddleware at v2.19.12 technical-description
• projectUserAPI environment routes at v2.19.12 technical-description
• https://github.com/semaphoreui/semaphore product
• VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests third-party-advisory