MEDIUM

CVE-2026-91994

2026-09-15 CVSS v3.1

CVSS

6.5

Description

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Weakness (CWE)

CWE-862 Missing Authorization

EPSS Score

0.3%

Probability of exploitation in next 30 days

23.3th percentile

References

https://github.com/semaphoreui/semaphore https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106 https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329 https://github.com/semaphoreui/semaphore/issues/4150 https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE