semaphore vulnerabilities

3 known vulnerabilities in semaphore from Semaphoreui. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.9 Critical severity

  semaphore: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-73294Aug 12, 2026Semaphoreui

  Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and

• 8.8 High severity

  semaphore: Improper Privilege Management

  CVE-2026-73293Aug 12, 2026Semaphoreui

  Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager rol

• 8.3 High severity

  semaphore: Cross-Site Request Forgery

  CVE-2026-73292Aug 12, 2026Semaphoreui

  Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.21, the /api/users/{id}/password endpoint accepts a cross-site request using the authenticated user's semaphore session cookie without CSRF protection or current-password confirmation, al