SemaphoreUI Semaphore up to 2.18.18/2.19.5-beta4 Role Management /api/project/{id}/roles ProjectMiddleware/GetProjectOrGlobalRoleBySlug privileges management

Summaryinfo

A vulnerability was found in SemaphoreUI Semaphore up to 2.18.18/2.19.5-beta4 and classified as problematic. Affected by this vulnerability is the function ProjectMiddleware/GetProjectOrGlobalRoleBySlug of the file /api/project/{id}/roles of the component Role Management. Executing a manipulation can lead to privileges management. This vulnerability is tracked as CVE-2026-73293. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in SemaphoreUI Semaphore up to 2.18.18/2.19.5-beta4 and classified as problematic. This vulnerability affects the function ProjectMiddleware/GetProjectOrGlobalRoleBySlug of the file /api/project/{id}/roles of the component Role Management. The manipulation with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect integrity, and availability. CVE summarizes:

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-73293 since 08/11/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 2.18.19 or 2.19.5-beta5 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• SemaphoreUI

Name

• Semaphore

Version

• 2.18.0
• 2.18.1
• 2.18.2
• 2.18.3
• 2.18.4
• 2.18.5
• 2.18.6
• 2.18.7
• 2.18.8
• 2.18.9
• 2.18.10
• 2.18.11
• 2.18.12
• 2.18.13
• 2.18.14
• 2.18.15
• 2.18.16
• 2.18.17
• 2.18.18
• 2.19.5-beta1
• 2.19.5-beta2
• 2.19.5-beta3
• 2.19.5-beta4

Website

• Product: https://github.com/semaphoreui/semaphore/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion