Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-91994 (GCVE-0-2026-91994)

Vulnerability from nvd – Published: 2026-09-15 11:35 – Updated: 2026-09-24 14:22

Title

Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Summary

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:36 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/issues/4150	issue-trackingexploit
https://github.com/semaphoreui/semaphore/blob/v2.…	technical-description
https://github.com/semaphoreui/semaphore/blob/v2.…	technical-description
https://github.com/semaphoreui/semaphore	product
https://www.vulncheck.com/advisories/semaphore-ui…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: 0 , ≤ 2.19.12 (semver)

Date Public

2026-08-16 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91994",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:36:45.634709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:36:59.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/semaphoreui/semaphore",
          "product": "semaphore",
          "repo": "https://github.com/semaphoreui/semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "lessThanOrEqual": "2.19.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:22:33.738Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #4150",
          "tags": [
            "issue-tracking",
            "exploit"
          ],
          "url": "https://github.com/semaphoreui/semaphore/issues/4150"
        },
        {
          "name": "GetMustCanMiddleware at v2.19.12",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106"
        },
        {
          "name": "projectUserAPI environment routes at v2.19.12",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/semaphoreui/semaphore"
        },
        {
          "name": "VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests"
        }
      ],
      "title": "Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91994",
    "datePublished": "2026-09-15T11:35:49.385Z",
    "dateReserved": "2026-09-15T11:11:13.312Z",
    "dateUpdated": "2026-09-24T14:22:33.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73682 (GCVE-0-2026-73682)

Vulnerability from nvd – Published: 2026-08-14 21:06 – Updated: 2026-08-19 14:16

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-73294 published by GitHub

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:16:41.196Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\u0026nbsp;CVE-2026-73294 published by GitHub"
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\u00a0CVE-2026-73294 published by GitHub"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-73682",
    "datePublished": "2026-08-14T21:06:36.069Z",
    "dateRejected": "2026-08-19T14:16:41.196Z",
    "dateReserved": "2026-08-13T15:15:35.896Z",
    "dateUpdated": "2026-08-19T14:16:41.196Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73294 (GCVE-0-2026-73294)

Vulnerability from nvd – Published: 2026-08-12 15:55 – Updated: 2026-08-12 16:03

Title

Semaphore U: OS Command Injection

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:03 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/7…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/a…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/tree/v2.18.17	x_refsource_MISC
https://github.com/semaphoreui/semaphore/tree/v2.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.17 Affected: >= 2.19.0-alpha3, < 2.19.5-beta2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73294",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:03:17.361594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:03:38.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:55:00.560Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/tree/v2.18.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/tree/v2.18.17"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2"
        }
      ],
      "source": {
        "advisory": "GHSA-xp7j-h7jc-4w8p",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore U: OS Command Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73294",
    "datePublished": "2026-08-12T15:55:00.560Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T16:03:38.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73293 (GCVE-0-2026-73293)

Vulnerability from nvd – Published: 2026-08-12 15:45 – Updated: 2026-08-12 16:56

Title

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:56 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/1…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/b…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.19 Affected: >= 2.19.0-alpha3, < 2.19.5-beta5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73293",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:56:05.968430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:56:45.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:45:22.145Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
        }
      ],
      "source": {
        "advisory": "GHSA-cxvf-gvfq-36w2",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73293",
    "datePublished": "2026-08-12T15:45:22.145Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T16:56:45.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73292 (GCVE-0-2026-73292)

Vulnerability from nvd – Published: 2026-08-12 15:34 – Updated: 2026-08-12 22:11

Title

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 22:09 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)
CWE-620 - Unverified Password Change

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/2…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/c…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T22:09:05.787908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T22:11:58.204Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user\u0027s semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator\u0027s or another user\u0027s password after user interaction. This issue is fixed in version 2.18.21."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:34:45.757Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21"
        }
      ],
      "source": {
        "advisory": "GHSA-8cj9-r88m-8945",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73292",
    "datePublished": "2026-08-12T15:34:45.757Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T22:11:58.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-91994 (GCVE-0-2026-91994)

Vulnerability from cvelistv5 – Published: 2026-09-15 11:35 – Updated: 2026-09-24 14:22

Title

Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests

Summary

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 12:36 UTC

CWE

CWE-862 - Missing Authorization

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/issues/4150	issue-trackingexploit
https://github.com/semaphoreui/semaphore/blob/v2.…	technical-description
https://github.com/semaphoreui/semaphore/blob/v2.…	technical-description
https://github.com/semaphoreui/semaphore	product
https://www.vulncheck.com/advisories/semaphore-ui…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: 0 , ≤ 2.19.12 (semver)

Date Public

2026-08-16 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-91994",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T12:36:45.634709Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T12:36:59.210Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/semaphoreui/semaphore",
          "product": "semaphore",
          "repo": "https://github.com/semaphoreui/semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "lessThanOrEqual": "2.19.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-08-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T14:22:33.738Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #4150",
          "tags": [
            "issue-tracking",
            "exploit"
          ],
          "url": "https://github.com/semaphoreui/semaphore/issues/4150"
        },
        {
          "name": "GetMustCanMiddleware at v2.19.12",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/projects/project.go#L89-L106"
        },
        {
          "name": "projectUserAPI environment routes at v2.19.12",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/semaphoreui/semaphore/blob/v2.19.12/api/router.go#L308-L329"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/semaphoreui/semaphore"
        },
        {
          "name": "VulnCheck Advisory: Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.12-missing-authorization-on-get-and-head-requests"
        }
      ],
      "title": "Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-91994",
    "datePublished": "2026-09-15T11:35:49.385Z",
    "dateReserved": "2026-09-15T11:11:13.312Z",
    "dateUpdated": "2026-09-24T14:22:33.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73682 (GCVE-0-2026-73682)

Vulnerability from cvelistv5 – Published: 2026-08-14 21:06 – Updated: 2026-08-19 14:16

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2026-73294 published by GitHub

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-08-19T14:16:41.196Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\u0026nbsp;CVE-2026-73294 published by GitHub"
            }
          ],
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\u00a0CVE-2026-73294 published by GitHub"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-73682",
    "datePublished": "2026-08-14T21:06:36.069Z",
    "dateRejected": "2026-08-19T14:16:41.196Z",
    "dateReserved": "2026-08-13T15:15:35.896Z",
    "dateUpdated": "2026-08-19T14:16:41.196Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73294 (GCVE-0-2026-73294)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:55 – Updated: 2026-08-12 16:03

Title

Semaphore U: OS Command Injection

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:03 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/7…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/a…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/tree/v2.18.17	x_refsource_MISC
https://github.com/semaphoreui/semaphore/tree/v2.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.17 Affected: >= 2.19.0-alpha3, < 2.19.5-beta2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73294",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:03:17.361594Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:03:38.426Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:55:00.560Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-xp7j-h7jc-4w8p"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/7e8a9434bd81b82cf42220151c74801ea97542d6"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/a7a7a33a64aea382a0726b3722856f298663eacf"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/tree/v2.18.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/tree/v2.18.17"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/tree/v2.19.5-beta2"
        }
      ],
      "source": {
        "advisory": "GHSA-xp7j-h7jc-4w8p",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore U: OS Command Injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73294",
    "datePublished": "2026-08-12T15:55:00.560Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T16:03:38.426Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73293 (GCVE-0-2026-73293)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:45 – Updated: 2026-08-12 16:56

Title

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:56 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

GitHub_M mitre root Scorecard

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/1…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/b…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.19 Affected: >= 2.19.0-alpha3, < 2.19.5-beta5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73293",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:56:05.968430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:56:45.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:45:22.145Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
        }
      ],
      "source": {
        "advisory": "GHSA-cxvf-gvfq-36w2",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73293",
    "datePublished": "2026-08-12T15:45:22.145Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T16:56:45.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-73292 (GCVE-0-2026-73292)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:34 – Updated: 2026-08-12 22:11

Title

Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator's or another user's password after user interaction. This issue is fixed in version 2.18.21.

Severity

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 22:09 UTC

CWE

CWE-352 - Cross-Site Request Forgery (CSRF)
CWE-620 - Unverified Password Change

Assigner

GitHub_M mitre root Scorecard

References

4 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/2…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/c…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
semaphoreui	semaphore	Affected: < 2.18.21

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73292",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T22:09:05.787908Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T22:11:58.204Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user\u0027s semaphore session cookie without CSRF protection or current-password confirmation, allowing an unauthenticated attacker to change an administrator\u0027s or another user\u0027s password after user interaction. This issue is fixed in version 2.18.21."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-620",
              "description": "CWE-620: Unverified Password Change",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:34:45.757Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-8cj9-r88m-8945"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/2d6e2e3eb10e8bf688e2ab59609b909a012fad4c"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/c59c3dc9035badcbf0609c7d35679c06e590a956"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.21"
        }
      ],
      "source": {
        "advisory": "GHSA-8cj9-r88m-8945",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore UI: CSRF vulnerability on password change endpoint - No CSRF token or password confirmation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73292",
    "datePublished": "2026-08-12T15:34:45.757Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T22:11:58.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

10 vulnerabilities by semaphoreui

CVE-2026-91994 (GCVE-0-2026-91994)

CVE-2026-73682 (GCVE-0-2026-73682)

CVE-2026-73294 (GCVE-0-2026-73294)

CVE-2026-73293 (GCVE-0-2026-73293)

CVE-2026-73292 (GCVE-0-2026-73292)

CVE-2026-91994 (GCVE-0-2026-91994)

CVE-2026-73682 (GCVE-0-2026-73682)

CVE-2026-73294 (GCVE-0-2026-73294)

CVE-2026-73293 (GCVE-0-2026-73293)

CVE-2026-73292 (GCVE-0-2026-73292)