CVE-2026-91994Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Descripción

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

Referencias y parches

• GitHub Issue #4150 issue-trackingexploit
• GetMustCanMiddleware at v2.19.12 technical-description
• projectUserAPI environment routes at v2.19.12 technical-description
• https://github.com/semaphoreui/semaphore product
• VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests third-party-advisory