CVE-2026-91994

Semaphore UI through version 2.19.12 fails to enforce project-level permission checks on GET and HEAD requests due to a flaw in the GetMustCanMiddleware, tracked as CVE-2026-91994 (CVSS 4.0: 7.1, CWE-862 missing authorization). An authenticated attacker holding a low-privilege role such as guest or task_runner can simply issue a GET request to the environment endpoint for any project, bypassing the authorization they should be subject to. This exposes all project environments, including plaintext secrets, credentials, and passwords, which often contain Ansible/SSH keys, API tokens, and infrastructure passwords in Semaphore deployments. Any organization self-hosting Semaphore UI at or below 2.19.12 with multi-user access (especially guest or task_runner accounts) is affected. No public proof-of-concept exists and the flaw is not in CISA's Known Exploited Vulnerabilities catalog, so exploitation status is none known.

What to do: Upgrade Semaphore UI to a release newer than 2.19.12 as soon as a fixed version is available. Until then, restrict network access to the Semaphore instance (VPN/allowlist), remove or suspend unnecessary guest and task_runner accounts, and audit access logs for GET/HEAD requests to environment endpoints made by low-privilege users. Rotate all secrets, credentials, and passwords stored in Semaphore project environments, since any low-privilege user may have already read them in plaintext.