CVE-2026-73293 PUBLISHED

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Assigner: GitHub_M
Reserved: 11.08.2026 Published: 12.08.2026 Updated: 12.08.2026

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	semaphoreui
Product	semaphore
Versions	Version < 2.18.19 is affected Version >= 2.19.0-alpha3, < 2.19.5-beta5 is affected

References

Problem Types

CWE-269: Improper Privilege Management CWE