CVE-2026-73293: Semaphore UI Privilege Escalation Flaw

CVE-2026-73293 Overview

Semaphore UI is a web interface for managing DevOps tools such as Ansible, Terraform, and OpenTofu. A privilege escalation flaw [CWE-269] in the ProjectMiddleware and GetProjectOrGlobalRoleBySlug functions allows a project manager to create a custom role that shadows the built-in manager role. By issuing a POST /api/project/{id}/roles request with a reserved slug and permission bitmask 15, the attacker grants themselves owner-level capabilities including CanUpdateProject and CanManageProjectUsers. The issue affects versions prior to 2.18.19 and from 2.19.0-alpha3 through 2.19.5-beta5.

Critical Impact
An authenticated project manager can escalate to full project owner permissions, gaining control over project configuration and user management.

Affected Products

Semaphore UI versions prior to 2.18.19
Semaphore UI versions 2.19.0-alpha3 through 2.19.5-beta5
Deployments exposing the /api/project/{id}/roles endpoint to project managers

Discovery Timeline

2026-08-12 - CVE-2026-73293 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-73293

Vulnerability Analysis

The vulnerability resides in Semaphore UI's role resolution logic. When the middleware resolved a user's effective permissions, it called GetProjectOrGlobalRoleBySlug against the database without first checking whether the slug matched a built-in role. If a custom project role in the database used the same slug as a built-in role (for example, manager), the database-backed role took precedence over the code-defined role.

A project manager could invoke POST /api/project/{id}/roles to create a custom role named with the reserved manager slug and set the permission bitmask to 15. This value combines CanUpdateProject, CanManageProjectUsers, and additional owner-tier capabilities. The middleware then applied those elevated permissions to every user assigned the shadowed role.

Root Cause

The root cause is missing input validation on role creation combined with insecure precedence in permission resolution. The AddRole validator rejected empty names but did not reject reserved slugs or empty slugs. The middleware trusted database results over the built-in role registry, enabling built-in roles to be silently overridden.

Attack Vector

Exploitation requires network access to the Semaphore UI API and valid credentials for an account holding the project manager role. No user interaction is required. The attacker sends a crafted role-creation request and immediately inherits owner-level authority within the target project.

// Patch in db/Role.go — reject empty and reserved slugs
if role.Name == "" {
    return &ValidationError{Message: "Role name cannot be empty"}
}
if role.Slug == "" {
    return &ValidationError{Message: "Role slug cannot be empty"}
}
// Built-in role slugs are reserved. Allowing a custom role to reuse one lets
// it shadow the built-in role and escalate the permissions of its members.
if ProjectUserRole(role.Slug).IsValid() {
    return &ValidationError{Message: "Role slug is reserved and cannot be used: " + role.Slug}
}
return nil

Source: GitHub Commit 1c4bb65

Detection Methods for CVE-2026-73293

Indicators of Compromise

POST /api/project/{id}/roles requests containing role slugs that match built-in values such as manager, owner, task_runner, or guest.
Custom roles in the database with permissions set to 15 or other elevated bitmask values not previously present.
Unexpected CanUpdateProject or CanManageProjectUsers actions performed by accounts previously limited to project manager scope.

Detection Strategies

Audit the Semaphore roles table for entries whose slug field collides with built-in role slugs defined in db/Role.go.
Review API access logs for role-creation calls followed by project configuration changes or user permission modifications from the same account.
Correlate role-creation events with subsequent template edits, inventory changes, or key material access.

Monitoring Recommendations

Forward Semaphore UI application logs and API access logs to a centralized log platform for behavioral analysis.
Alert on any successful POST /api/project/*/roles request outside of change windows or approved administrator activity.
Baseline the set of custom roles per project and alert on new roles created by non-owner accounts.

How to Mitigate CVE-2026-73293

Immediate Actions Required

Upgrade Semaphore UI to version 2.18.19 or 2.19.5-beta5 immediately.
Enumerate existing custom roles and delete any whose slug matches a built-in role name.
Rotate any secrets, SSH keys, or API tokens managed within projects where suspicious role activity is observed.

Patch Information

The fix is delivered in Semaphore UI v2.18.19 and v2.19.5-beta5. The patch introduces slug validation in db/Role.go and modifies ProjectMiddleware to resolve built-in roles from code before consulting the database. Full technical details are in GHSA-cxvf-gvfq-36w2.

Workarounds

Restrict the project manager role to trusted operators until the upgrade is applied.
Place the Semaphore UI API behind an authenticated reverse proxy that blocks POST /api/project/*/roles for non-owner accounts.
Manually inspect the roles table before restart and remove any role whose slug shadows a built-in identifier.

bash

# Verify installed Semaphore version and upgrade via container image
semaphore version
docker pull semaphoreui/semaphore:v2.18.19
docker stop semaphore && docker rm semaphore
docker run -d --name semaphore \
  -p 3000:3000 \
  -e SEMAPHORE_DB_DIALECT=bolt \
  semaphoreui/semaphore:v2.18.19