Description

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-15T12:17:54.793Z",
  "pubdate": "2026-09-15T12:17:54.793Z",
  "executiveSummary": "This vulnerability is a critical Broken Access Control flaw identified in Semaphore UI versions through 2.19.12. The security defect arises from an improper implementation of authorization logic within the middleware responsible for project resource protection.\nSpecifically, the 'GetMustCanMiddleware' function fails to enforce mandatory permission checks for HTTP GET and HEAD requests. This oversight allows authenticated users with low-privileged roles, such as 'guest' or 'task_runner', to bypass intended authorization boundaries.\nThe impact is severe, as it grants unauthorized access to sensitive project metadata and configuration resources. An attacker can perform reconnaissance and data exfiltration by querying the environment endpoint, leading to the unauthorized disclosure of plaintext secrets, database credentials, API keys, and administrative passwords.\nGiven that these credentials often grant further access to integrated infrastructure or CI/CD pipelines, the risk of escalation and full compromise of the underlying environment is extremely high. Exploitation requires only basic network access to the Semaphore UI instance and a valid low-privilege user account.",
  "technicalDetails": "The vulnerability resides within the 'GetMustCanMiddleware' component of the Semaphore UI application. This middleware is intended to act as a security gatekeeper for API requests targeting project-specific resources, ensuring that only users with sufficient permissions can interact with sensitive project data.\nThe root cause is a logic error where the middleware explicitly exempts HTTP GET and HEAD methods from the permission validation process. While this may have been intended to allow public visibility of non-sensitive resource metadata, it creates a bypass for authorization checks on critical endpoints, most notably those managing environment configurations.\nThe exploitation flow is straightforward: an attacker authenticates to the Semaphore UI using a low-privileged account (guest or task_runner). Despite these roles having restricted access under normal circumstances, the attacker can leverage the flawed middleware to access the project environment API endpoints (e.g., /api/project/:project_id/environment).\nBecause the middleware fails to validate the user's role before processing the request, the application backend proceeds to retrieve and return the full JSON representation of the project's environment variables. In Semaphore UI, these environments often store sensitive data, such as production database strings, cloud service access keys, and other application secrets, in plaintext.\nBy issuing a standard GET request to these endpoints, an attacker can enumerate every project configured within the system and scrape all associated sensitive secrets. The vulnerability is effective because the underlying service logic prioritizes the request method over the authentication and authorization state of the user. This exposes the entire configuration surface of the Semaphore UI, effectively bypassing all role-based access control (RBAC) mechanisms intended to protect project-specific secrets from unauthorized eyes.\nPost-exploitation, an attacker can use the discovered credentials to move laterally within the organization's network, gain unauthorized access to connected cloud providers, or modify CI/CD pipelines to inject malicious code into production deployments, leading to a total loss of integrity and confidentiality for the affected projects."
}