Semaphore UI CVE-2026-73293

Exploitation requires an active authenticated session holding the project manager role within the targeted Semaphore UI project - the CVSS PR:L vector confirms low-privilege authentication is the minimum entry bar. No special or non-default server configuration is required; the vulnerable code paths (ProjectMiddleware and GetProjectOrGlobalRoleBySlug) execute on all default deployments of affected versions whenever the roles API is used. The limiting factor is role-based: a guest or task_runner account cannot trigger this flaw without first being promoted to project manager. A fully external, unauthenticated attacker cannot exploit this without first compromising or obtaining valid project manager credentials. Exploitation is also scoped to individual projects - the attacker gains owner-level control only within projects where their manager account has membership, not across all projects on the instance.

The CVSS 8.8 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the threat model: a single authenticated API call with no prerequisites beyond holding a project manager role is sufficient to escalate to owner-level. The attack succeeds against default-configured instances - no special features need to be enabled. No EPSS score was included in the provided intelligence, so exploitation probability cannot be quantified numerically; this is a notable data gap. The vulnerability is absent from CISA KEV, and no public proof-of-concept has been identified, which moderates the immediate opportunistic threat. However, the insider risk is high: any project manager who discovers the flaw can silently escalate without triggering obvious anomalies, since creating a custom role is a legitimate API function. The C:H/I:H/A:H impact ratings are justified by full project takeover - an escalated attacker can modify project settings, add or evict users, and potentially disrupt automation workflows. This is a real priority for organizations where Semaphore is internet-exposed or where project manager accounts are shared or weakly controlled.

An attacker authenticated to a vulnerable Semaphore instance as a project manager sends a POST request to /api/project/{project_id}/roles with JSON body specifying slug='manager' and permissions=15. The unpatched ProjectMiddleware resolves this custom database role instead of the built-in manager definition, and the attacker's session is now treated as carrying CanUpdateProject and CanManageProjectUsers - capabilities reserved for project owners. The attacker can then modify project settings, add a second controlled account as project owner, or remove legitimate owners, achieving persistent elevated access within that project.