6.5Orta
CVE-2026-91994Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
Açıklama
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Zayıflık türü (CWE):
CWE-862
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| semaphoreui | semaphore | ≤ 2.19.12 |
Kaynaklar ve yamalar
- GitHub Issue #4150 issue-trackingexploit
- GetMustCanMiddleware at v2.19.12 technical-description
- projectUserAPI environment routes at v2.19.12 technical-description
- https://github.com/semaphoreui/semaphore product
- VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests third-party-advisory