Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Source published

12 Aug 2026 15:45:22 UTC

Source modified

12 Aug 2026 16:56:45 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Source published

12 Aug 2026 16:17:22 UTC

Source modified

24 Oct 2026 15:10:00 UTC

Observed here

25 Oct 2026 15:19:03 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 3.1 · [email protected] · Secondary · 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

## Summary Semaphore resolves a project member's effective permissions in `ProjectMiddleware` by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in `manager` role creates a custom project role through `POST /api/project/{id}/roles`, a route gated only by the `CanManageProjectResources` permission that `manager` already holds. The role-creation validator does not reserve the built-in slug names (`owner`, `manager`, `task_runner`, `guest`) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug `manager` carrying the full bitmask `15`, including the two owner-only bits `CanUpdateProject` and `CanManageProjectUsers` that `manager` does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager's effective permissions become owner-equivalent. Result: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner. ## Affected semaphoreui/semaphore v2.18.12 (current latest as of 2026-06-09) and `develop` HEAD. Confirmed live-exploitable on v2.18.12 (commit 8a4dcf0); the affected files are unchanged on `develop` with no fix commit since the tag. Earlier releases that ship PRO custom project roles are likely affected but were not tested. Requires the PRO build (custom project roles). The official `semaphoreui/semaphore` Docker image ships this feature active by default, with no subscription or configuration flag. Pure community builds without custom project roles are not affected: the role-creation endpoint returns 404 there. ## Root cause `ProjectMiddleware` reads the member's built-in role permissions, then calls `GetProjectOrGlobalRoleBySlug` and, when a role row shares the member's role slug, replaces the effective permission bitmask with the database value (`api/projects/project.go:49-53`). `GetProjectOrGlobalRoleBySlug(projectID, slug)` accepts a project id but runs `select * from role where slug=?`, ignoring project scope (`db/sql/role.go:59-62`). `ValidateRole` checks only that the role name is non-empty, and enforces neither a reserved-slug list nor a permission ceiling (`db/Role.go:10-15`). The role-creation route `POST /api/project/{id}/roles` is gated by `CanManageProjectResources` (`api/router.go:294,354`), a bit the built-in `manager` role holds, while the actions it unlocks are gated by the owner-only `CanUpdateProject` and `CanManageProjectUsers` (`api/router.go:364,380`). A manager creates a row with slug `manager` and permissions `15`, and the next request resolves the manager's effective permissions to the owner bitmask. ## Reproduction semaphoreui/semaphore v2.18.12 Docker (official image, PRO build), default config, default roles. 1. An admin or owner adds the attacker to a project with the built-in `manager` role; the attacker confirms the baseline, where owner-only endpoints are denied. ``` GET /api/project/42/role Cookie: semaphore=<manager-session> -> {"role":"manager","permissions":5} PUT /api/project/42 Cookie: semaphore=<manager-session> -> HTTP/1.1 403 Forbidden ``` 2. The manager creates a custom role whose slug collides with the built-in `manager` and carries every permission bit. ``` POST /api/project/42/roles Cookie: semaphore=<manager-session> Content-Type: application/json {"slug":"manager","name":"pwn","permissions":15} -> HTTP/1.1 201 Created {"slug":"manager","name":"pwn","permissions":15,"project_id":42} ``` 3. On the next request the manager holds the owner bitmask and performs owner-only actions. ``` GET /api/project/42/role -> {"role":"manager","permissions":15} PUT /api/project/42 {"id":42,"name":"owned","alert":false} -> 204 No Content POST /api/project/42/users {"user_id":99,"role":"task_runner"} -> 204 No Content ``` Live-verified: a manager with permissions `5` obtains permissions `15` with one POST, then changes project settings and adds project members, both of which return 403 before the role is created. ## Impact - Full administrative control of the project from a non-owner role: change project settings, delete the project. - Add, remove, and re-role project members, including granting roles the attacker should not control. - Removal or demotion of the legitimate project owner. - Reached by the project `manager` role in default config with one request; not reachable by `task_runner`, `guest`, or unauthenticated callers. ## Credit Jan Kahmen, [turingpoint](https://www.turingpoint.de) ([email protected])

Source published

3 Sep 2026 19:23:42 UTC

Source modified

10 Sep 2026 15:25:39 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Publisher rating · HIGH

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision in github.com/semaphoreui/semaphore

Source published

10 Sep 2026 14:48:42 UTC

Source modified

10 Sep 2026 15:15:13 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.