CVE-2026-91994 in Semaphore
الملخص
بحسب MITRE • 15/09/2026
Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.