CVE-2026-91994 — Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read al…
Published: 2026-09-15 · CVSS: 7.1 · CVSS 4.0
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7