Semaphore UI role hack lets managers steal project control

Published September 3, 2026 CVE-2026-73293

Semaphore UI, a DevOps tool for managing projects, has a flaw that lets project managers create a fake admin role. Attackers could trick a manager into giving them full control over a project.

Severity
HighCVSS 3.1 · 8.8
Fix
Fixed in 0.0.0-20260705182501-bb2a4e1f08c8Fix recorded on Sep 3, 2026
Affected versions
before 0.0.0-20260705182501-bb2a4e1f08c8
Weakness
CWE-269Improper Privilege Management
Exploit likelihood
0.50% in 30 daysEPSS, higher than 41% of known flaws
Affects
Semaphore UI

How it works

A project manager sends a fake role request to the Semaphore API, tricking it into giving them full project control instead of just manager access.

What to do

Check whether the installed Semaphore UI version is older than 2.18.19.

Update to Semaphore UI 2.18.19 or 2.19.5-beta5 or newer through the built-in updater, then verify your version again.

Technical details

Semaphore UI, a web interface for managing DevOps tools, contains an authorization bypass in its role management system. In versions older than 2.18.19 and from 2.19.0-alpha3 up to 2.19.5-beta5, the ProjectMiddleware and GetProjectOrGlobalRoleBySlug components allow project managers to abuse the /api/project/{id}/roles endpoint via a POST request. By crafting a custom role with a permission bitmask of 15, attackers can override default manager permissions, granting themselves CanUpdateProject and CanManageProjectUsers privileges, effectively elevating their access to full project ownership. This issue is patched in 2.18.19 and 2.19.5-beta5.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source