CVE-2026-73293 in Semaphore
Summary
by MITRE • 08/12/2026
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The vulnerability described involves a critical access control flaw within Semaphore UI, a web-based DevOps management interface that provides project management capabilities for development teams. This weakness exists in specific version ranges of the software where the authorization mechanism fails to properly validate user permissions when creating custom roles within project contexts. The flaw stems from insufficient input validation and privilege escalation opportunities within the role management system, allowing unauthorized users to manipulate permission bitmasks beyond their intended scope.
The technical implementation of this vulnerability occurs through the ProjectMiddleware and GetProjectOrGlobalRoleBySlug components which handle role creation and retrieval operations. When a project manager attempts to create a custom role using the POST /api/project/{id}/roles endpoint, the system accepts a permission bitmask value of 15 without proper validation against established security boundaries. This specific bitmask value corresponds to a combination of permissions that includes CanUpdateProject and CanManageProjectUsers, effectively granting owner-level capabilities to users who should only possess manager privileges. The vulnerability represents a classic case of insufficient authorization checks where the system fails to verify that the requesting user has appropriate elevated permissions to assign such high-privilege bitmasks.
The operational impact of this vulnerability is significant as it allows project managers to escalate their privileges within the DevOps environment, potentially compromising the entire project management infrastructure. An attacker or malicious insider could exploit this weakness to gain unauthorized access to project configuration changes, user management capabilities, and other sensitive operations that should be restricted to system administrators or owners. This creates a potential pathway for data breaches, unauthorized modifications to development workflows, and complete compromise of project security boundaries within the Semaphore UI platform.
The vulnerability aligns with CWE-285 (Improper Authorization) and represents a direct violation of the principle of least privilege in information security. From an ATT&CK framework perspective, this issue maps to T1078 (Valid Accounts) and T1484 (Domain Policy Modification) as it allows for privilege escalation through legitimate user accounts and unauthorized configuration changes. The fix implemented in versions 2.18.19 and 2.19.5-beta5 addresses this by introducing proper permission validation mechanisms that ensure role creation operations cannot escalate privileges beyond the user's inherent permissions, thereby maintaining proper access control boundaries within the application.
Organizations utilizing Semaphore UI should immediately upgrade to the patched versions to mitigate this risk, while security teams should monitor for potential exploitation attempts through anomalous role creation activities and implement additional logging controls around permission-related API endpoints. The vulnerability demonstrates the critical importance of validating all user inputs in authorization systems and implementing proper privilege boundaries even within trusted administrative functions.