semaphoreui github.com/semaphoreui/semaphore vulnerabilities

Latest semaphoreui github.com/semaphoreui/semaphore CVEs

Newest publication first

1. CVE-2026-91994 Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

   Published 2026-09-15

   High·CVSS 7.1 EPSS 0.42%

   Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the...

2. GHSA-xp7j-h7jc-4w8p Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore

   Published 2026-09-10

   Critical·CVSS 9.9

   Semaphore U: OS Command Injection in github.com/semaphoreui/semaphore

3. CVE-2026-73294 Semaphore U: OS Command Injection

   Published 2026-08-12

   Critical·CVSS 9.9 EPSS 0.65%

   Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-ha...

4. CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

   Published 2026-08-12

   High·CVSS 8.8 EPSS 0.57%

   Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bi...

5. CVE-2026-73292 Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

   Published 2026-08-12

   High·CVSS 8.3 EPSS 0.23%

   Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenti...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.