Role Management Flaw in Semaphore UI Affecting ProjectManagers
CVE-2026-73293
8.8HIGH
What is CVE-2026-73293?
Semaphore UI, a web interface designed for managing DevOps tools, has a vulnerability that allows project managers to misuse the POST /api/project/{id}/roles endpoint to create custom manager roles. This flaw enables the overriding of intrinsic manager permissions, allowing unauthorized capabilities, including CanUpdateProject and CanManageProjectUsers, thus granting additional privileges typically reserved for owners. The vulnerability has been addressed in versions 2.18.19 and 2.19.5-beta5.
Affected Version(s)
semaphore < 2.18.19 < 2.18.19
semaphore >= 2.19.0-alpha3, < 2.19.5-beta5 < 2.19.0-alpha3, 2.19.5-beta5