Executive brief
Semaphore UI is a web interface for managing Ansible and infrastructure automation tasks. The application improperly exempts GET and HEAD requests from permission checks on project resources, allowing users with limited guest or task runner roles to retrieve sensitive environment data including plaintext credentials and passwords that should be restricted.
Technical details
The vulnerability is an authorization bypass in the GetMustCanMiddleware component that enforces project resource permissions. GET and HEAD HTTP requests are exempted from permission checks on the environment endpoint, allowing attackers with guest or task_runner roles to read all project environments via unauthenticated or low-privileged GET requests. The vulnerability exists through version 2.19.12 and exposes plaintext secrets and credentials stored in environment configurations. Authentication is required (attacker must have a guest or task_runner role), but the authorization check is completely bypassed for these HTTP methods.
Affected products
- Semaphore UI Semaphore through 2.19.12
Timeline
- 2026-09-15: disclosed