Medium severity6.5NVD Advisory· Published Sep 15, 2026· Updated Sep 15, 2026
CVE-2026-91994
CVE-2026-91994
Description
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=2.19.12
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.