CVE-2026-73293: Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Semaphore UIto a version that resolves this vulnerability.Fixed in 2.18.19 - Upgrade
Upgrade
Semaphore UIto a version that resolves this vulnerability.Fixed in 2.19.5-beta5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73293?
CVE-2026-73293 has a high severity score of 8.8.
What are the potential impacts of CVE-2026-73293?
CVE-2026-73293 can allow a project manager to escalate privileges and potentially gain full access to project roles.
How do I fix CVE-2026-73293?
To mitigate CVE-2026-73293, update Semaphore UI to version 2.18.19 or 2.19.5-beta6 or later.
Who is affected by CVE-2026-73293?
Users of Semaphore UI versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 are affected by CVE-2026-73293.
What components of Semaphore UI are involved in CVE-2026-73293?
CVE-2026-73293 involves ProjectMiddleware and GetProjectOrGlobalRoleBySlug components that manage role creation.