Vulnerability-Lookup

CVE-2026-73293 (GCVE-0-2026-73293)

Vulnerability from cvelistv5 – Published: 2026-08-12 15:45 – Updated: 2026-08-12 16:56

Title

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-12 16:56 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/semaphoreui/semaphore/security…	x_refsource_CONFIRM
https://github.com/semaphoreui/semaphore/commit/1…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/commit/b…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC
https://github.com/semaphoreui/semaphore/releases…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
semaphoreui	semaphore	Affected: < 2.18.19 Affected: >= 2.19.0-alpha3, < 2.19.5-beta5	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73293",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:56:05.968430Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-12T16:56:45.324Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-12T15:45:22.145Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
        },
        {
          "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
        }
      ],
      "source": {
        "advisory": "GHSA-cxvf-gvfq-36w2",
        "discovery": "UNKNOWN"
      },
      "title": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-73293",
    "datePublished": "2026-08-12T15:45:22.145Z",
    "dateReserved": "2026-08-11T19:42:11.450Z",
    "dateUpdated": "2026-08-12T16:56:45.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-73293",
      "date": "2026-09-23",
      "epss": "0.00498",
      "percentile": "0.41776"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "semaphore",
                "vendor": "semaphoreui",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.18.19"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
          }
        ],
        "id": "CVE-2026-73293",
        "lastModified": "2026-09-09T21:02:22.660",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-73293",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-12T16:56:05.968430Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-12T16:17:22.493",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-269"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-21T16:40:48Z",
      "cve": "CVE-2026-73293",
      "id": "CVE-2026-73293",
      "initial_release_date": "2026-09-21T16:40:48Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-73293",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-73293.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-73293",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-12T16:56:05.968430Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-12T16:56:33.413Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "semaphore",
              "vendor": "semaphoreui",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.18.19"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269: Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-12T15:45:22.145Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
            },
            {
              "name": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
            },
            {
              "name": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
            },
            {
              "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
            },
            {
              "name": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
            }
          ],
          "source": {
            "advisory": "GHSA-cxvf-gvfq-36w2",
            "discovery": "UNKNOWN"
          },
          "title": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-73293",
        "datePublished": "2026-08-12T15:45:22.145Z",
        "dateReserved": "2026-08-11T19:42:11.450Z",
        "dateUpdated": "2026-08-12T16:56:45.324Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-73293

Vulnerability from fkie_nvd - Published: 2026-08-12 16:17 - Updated: 2026-09-09 21:02

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68
	security-advisories@github.com	https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb
	security-advisories@github.com	https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19
	security-advisories@github.com	https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5
	security-advisories@github.com	https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "semaphore",
          "vendor": "semaphoreui",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.18.19"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.19.0-alpha3, \u003c 2.19.5-beta5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Semaphore UI is a web interface for managing DevOps tools.  Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5."
    }
  ],
  "id": "CVE-2026-73293",
  "lastModified": "2026-09-09T21:02:22.660",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73293",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-12T16:56:05.968430Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-12T16:17:22.493",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-CXVF-GVFQ-36W2

Vulnerability from github – Published: 2026-09-03 19:23 – Updated: 2026-09-03 19:23

Summary

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Details

Summary

Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds.

The role-creation validator does not reserve the built-in slug names (owner, manager, task_runner, guest) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug manager carrying the full bitmask 15, including the two owner-only bits CanUpdateProject and CanManageProjectUsers that manager does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager's effective permissions become owner-equivalent.

Result: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.

Affected

semaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and develop HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on develop with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested.

Requires the PRO build (custom project roles). The official semaphoreui/semaphore Docker image ships this feature active by default, with no subscription or configuration flag.

Pure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there.

Root cause

ProjectMiddleware reads the member's built-in role permissions, then calls GetProjectOrGlobalRoleBySlug and, when a role row shares the member's role slug, replaces the effective permission bitmask with the database value (api/projects/project.go:49-53). GetProjectOrGlobalRoleBySlug(projectID, slug) accepts a project id but runs select * from role where slug=?, ignoring project scope (db/sql/role.go:59-62). ValidateRole checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (db/Role.go:10-15). The role-creation route POST /api/project/{id}/roles is gated by CanManageProjectResources (api/router.go:294,354), a bit the built-in manager role holds, while the actions it unlocks are gated by the owner-only CanUpdateProject and CanManageProjectUsers (api/router.go:364,380). A manager creates a row with slug manager and permissions 15, and the next request resolves the manager's effective permissions to the owner bitmask.

Reproduction

semaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles.

An admin or owner adds the attacker to a project with the built-in manager role; the attacker confirms the baseline, where owner-only endpoints are denied.

GET  /api/project/42/role     Cookie: semaphore=<manager-session>
  -> {"role":"manager","permissions":5}
PUT  /api/project/42          Cookie: semaphore=<manager-session>
  -> HTTP/1.1 403 Forbidden

The manager creates a custom role whose slug collides with the built-in manager and carries every permission bit.

POST /api/project/42/roles    Cookie: semaphore=<manager-session>
Content-Type: application/json
{"slug":"manager","name":"pwn","permissions":15}
  -> HTTP/1.1 201 Created
     {"slug":"manager","name":"pwn","permissions":15,"project_id":42}

On the next request the manager holds the owner bitmask and performs owner-only actions.

GET  /api/project/42/role  -> {"role":"manager","permissions":15}
PUT  /api/project/42       {"id":42,"name":"owned","alert":false}      -> 204 No Content
POST /api/project/42/users {"user_id":99,"role":"task_runner"}         -> 204 No Content

Live-verified: a manager with permissions 5 obtains permissions 15 with one POST, then changes project settings and adds project members, both of which return 403 before the role is created.

Impact

Full administrative control of the project from a non-owner role: change project settings, delete the project.
Add, remove, and re-role project members, including granting roles the attacker should not control.
Removal or demotion of the legitimate project owner.
Reached by the project manager role in default config with one request; not reachable by task_runner, guest, or unauthenticated callers.

Credit

Jan Kahmen, turingpoint (jan@turingpoint.de)

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/semaphoreui/semaphore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20260705182501-bb2a4e1f08c8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-73293"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-03T19:23:42Z",
    "nvd_published_at": "2026-08-12T16:17:22Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nSemaphore resolves a project member\u0027s effective permissions in `ProjectMiddleware` by looking up a role row whose slug matches the member\u0027s assigned role, and overwrites the built-in permission bitmask with that row\u0027s value. A member holding the built-in `manager` role creates a custom project role through `POST /api/project/{id}/roles`, a route gated only by the `CanManageProjectResources` permission that `manager` already holds.\n\nThe role-creation validator does not reserve the built-in slug names (`owner`, `manager`, `task_runner`, `guest`) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug `manager` carrying the full bitmask `15`, including the two owner-only bits `CanUpdateProject` and `CanManageProjectUsers` that `manager` does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager\u0027s effective permissions become owner-equivalent.\n\nResult: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.\n\n## Affected\n\nsemaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and `develop` HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on `develop` with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested.\n\nRequires the PRO build (custom project roles). The official `semaphoreui/semaphore` Docker image ships this feature active by default, with no subscription or configuration flag.\n\nPure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there.\n\n## Root cause\n\n`ProjectMiddleware` reads the member\u0027s built-in role permissions, then calls `GetProjectOrGlobalRoleBySlug` and, when a role row shares the member\u0027s role slug, replaces the effective permission bitmask with the database value (`api/projects/project.go:49-53`). `GetProjectOrGlobalRoleBySlug(projectID, slug)` accepts a project id but runs `select * from role where slug=?`, ignoring project scope (`db/sql/role.go:59-62`). `ValidateRole` checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (`db/Role.go:10-15`). The role-creation route `POST /api/project/{id}/roles` is gated by `CanManageProjectResources` (`api/router.go:294,354`), a bit the built-in `manager` role holds, while the actions it unlocks are gated by the owner-only `CanUpdateProject` and `CanManageProjectUsers` (`api/router.go:364,380`). A manager creates a row with slug `manager` and permissions `15`, and the next request resolves the manager\u0027s effective permissions to the owner bitmask.\n\n## Reproduction\n\nsemaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles.\n\n1. An admin or owner adds the attacker to a project with the built-in `manager` role; the attacker confirms the baseline, where owner-only endpoints are denied.\n\n```\nGET  /api/project/42/role     Cookie: semaphore=\u003cmanager-session\u003e\n  -\u003e {\"role\":\"manager\",\"permissions\":5}\nPUT  /api/project/42          Cookie: semaphore=\u003cmanager-session\u003e\n  -\u003e HTTP/1.1 403 Forbidden\n```\n\n2. The manager creates a custom role whose slug collides with the built-in `manager` and carries every permission bit.\n\n```\nPOST /api/project/42/roles    Cookie: semaphore=\u003cmanager-session\u003e\nContent-Type: application/json\n{\"slug\":\"manager\",\"name\":\"pwn\",\"permissions\":15}\n  -\u003e HTTP/1.1 201 Created\n     {\"slug\":\"manager\",\"name\":\"pwn\",\"permissions\":15,\"project_id\":42}\n```\n\n3. On the next request the manager holds the owner bitmask and performs owner-only actions.\n\n```\nGET  /api/project/42/role  -\u003e {\"role\":\"manager\",\"permissions\":15}\nPUT  /api/project/42       {\"id\":42,\"name\":\"owned\",\"alert\":false}      -\u003e 204 No Content\nPOST /api/project/42/users {\"user_id\":99,\"role\":\"task_runner\"}         -\u003e 204 No Content\n```\n\nLive-verified: a manager with permissions `5` obtains permissions `15` with one POST, then changes project settings and adds project members, both of which return 403 before the role is created.\n\n## Impact\n\n- Full administrative control of the project from a non-owner role: change project settings, delete the project.\n- Add, remove, and re-role project members, including granting roles the attacker should not control.\n- Removal or demotion of the legitimate project owner.\n- Reached by the project `manager` role in default config with one request; not reachable by `task_runner`, `guest`, or unauthenticated callers.\n\n## Credit\n\nJan Kahmen, [turingpoint](https://www.turingpoint.de) (jan@turingpoint.de)",
  "id": "GHSA-cxvf-gvfq-36w2",
  "modified": "2026-09-03T19:23:42Z",
  "published": "2026-09-03T19:23:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73293"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/semaphoreui/semaphore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19"
    },
    {
      "type": "WEB",
      "url": "https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-73293 (GCVE-0-2026-73293)

FKIE_CVE-2026-73293

GHSA-CXVF-GVFQ-36W2

Summary

Affected

Root cause

Reproduction

Impact

Credit

Tags

Sightings

Nomenclature

Related by attack behaviour