GHSA-cxvf-gvfq-36w2: High severity go/github.com/semaphoreui/semaphore vulnerability
Summary
Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds.
The role-creation validator does not reserve the built-in slug names (owner, manager, taskrunner, guest) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug manager carrying the full bitmask 15, including the two owner-only bits CanUpdateProject and CanManageProjectUsers that manager does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager's effective permissions become owner-equivalent.
Result: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.
Affected
semaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and develop HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on develop with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested.
Requires the PRO build (custom project roles). The official semaphoreui/semaphore Docker image ships this feature active by default, with no subscription or configuration flag.
Pure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there.
Root cause
ProjectMiddleware reads the member's built-in role permissions, then calls GetProjectOrGlobalRoleBySlug and, when a role row shares the member's role slug, replaces the effective permission bitmask with the database value (api/projects/project.go:49-53). GetProjectOrGlobalRoleBySlug(projectID, slug) accepts a project id but runs select from role where slug=?, ignoring project scope (db/sql/role.go:59-62). ValidateRole checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (db/Role.go:10-15). The role-creation route POST /api/project/{id}/roles is gated by CanManageProjectResources (api/router.go:294,354), a bit the built-in manager role holds, while the actions it unlocks are gated by the owner-only CanUpdateProject and CanManageProjectUsers (api/router.go:364,380). A manager creates a row with slug manager and permissions 15, and the next request resolves the manager's effective permissions to the owner bitmask.
Reproduction
semaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles.
1. An admin or owner adds the attacker to a project with the built-in manager role; the attacker confirms the baseline, where owner-only endpoints are denied.
GET /api/project/42/role Cookie: semaphore=<manager-session> -> {"role":"manager","permissions":5} PUT /api/project/42 Cookie: semaphore=<manager-session> -> HTTP/1.1 403 Forbidden
2. The manager creates a custom role whose slug collides with the built-in manager and carries every permission bit.
POST /api/project/42/roles Cookie: semaphore=<manager-session> Content-Type: application/json {"slug":"manager","name":"pwn","permissions":15} -> HTTP/1.1 201 Created {"slug":"manager","name":"pwn","permissions":15,"projectid":42}
3. On the next request the manager holds the owner bitmask and performs owner-only actions.
GET /api/project/42/role -> {"role":"manager","permissions":15} PUT /api/project/42 {"id":42,"name":"owned","alert":false} -> 204 No Content POST /api/project/42/users {"userid":99,"role":"taskrunner"} -> 204 No Content
Live-verified: a manager with permissions 5 obtains permissions 15 with one POST, then changes project settings and adds project members, both of which return 403 before the role is created.
Impact
- Full administrative control of the project from a non-owner role: change project settings, delete the project. - Add, remove, and re-role project members, including granting roles the attacker should not control. - Removal or demotion of the legitimate project owner. - Reached by the project manager role in default config with one request; not reachable by taskrunner, guest, or unauthenticated callers.
Credit
Jan Kahmen, turingpoint (jan@turingpoint.de)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/semaphoreui/semaphoreto a version that resolves this vulnerability.Fixed in 0.0.0-20260705182501-bb2a4e1f08c8 - Upgrade
Upgrade
semaphoreui/semaphoreto a version that resolves this vulnerability.Fixed in 2.18.12 - Configuration
Update the role-creation validator to reserve and reject custom project role slugs named exactly "owner", "manager", "task_runner", and "guest" (the exploit creates a custom role with slug "manager" and permissions bitmask 15).
semaphoreui/semaphore (PRO custom project roles) POST /api/project/{id}/roles role slug reservation = Reserve built-in slugs (owner, manager, task_runner, guest) so custom roles cannot be created with these slugs - Configuration
Modify ValidateRole to cap the permissions bitmask a caller may assign when creating a custom role, preventing a manager (who only holds permissions 5) from creating a role row with full permissions 15 including owner-only bits CanUpdateProject and CanManageProjectUsers.
semaphoreui/semaphore (PRO custom project roles) ValidateRole permission ceiling = Enforce a permission ceiling so callers cannot grant bits they do not already hold (including owner-only bits CanUpdateProject and CanManageProjectUsers) - Configuration
Fix GetProjectOrGlobalRoleBySlug to honor project scope (the current behavior ignores project scope: select * from role where slug=?), so an attacker-created role row cannot be returned on subsequent ProjectMiddleware permission resolution just because the slug matches.
semaphoreui/semaphore (RBAC role resolution) GetProjectOrGlobalRoleBySlug project scoping = Scope the slug lookup by project_id (do not run select * from role where slug=? without project scope) - Compensating control
Apply an external mitigation until a fixed build is deployed: restrict access to the role-creation endpoint POST /api/project/{id}/roles so only true owners (not managers) can call it, matching the owner-only permissions needed for the actions it unlocks.
- Operational
Review projects for attacker-created custom roles with slug "manager" and permissions "15" (including project_id rows like {"slug":"manager","permissions":15}), and remove/demote any unexpected custom roles and re-add legitimate project owners.
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker must be authenticated as a project member holding the built-in manager role. No user interaction is required, and exploitation uses the project role-creation endpoint that managers can access.
What does successful exploitation allow?
A manager can make their effective permissions owner-equivalent by creating a custom role using the manager slug with permission bitmask 15. They can then manage project members, modify project settings, delete the project, or demote the legitimate owner.
What indicators can be used to investigate potential exploitation?
Review custom project role records for reserved built-in slugs: owner, manager, task_runner, and guest. In particular, a custom role using the manager slug with permission bitmask 15 is consistent with the described escalation path.