CVE-2026-91994: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user assigned a guest or task_runner role can exploit it. No user interaction is required.
What information can be exposed?
Affected users can read project environments through GET requests to the environment endpoint. Those environments may contain plaintext secrets, credentials, and passwords.
Are installations affected by request method or configuration?
The authorization bypass applies to GET and HEAD requests because those methods are exempted from project resource permission checks in GetMustCanMiddleware. The provided data does not identify any configuration prerequisite beyond having a guest or task_runner account.
How can I determine whether an environment is vulnerable?
Semaphore UI versions through 2.19.12 are affected. A practical validation is to use a guest or task_runner account to request an environment belonging to a project that account is not permitted to access; successful retrieval indicates exposure.