What is the CVSS score of EUVD-2026-57317?

EUVD-2026-57317 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Semaphore UI are affected by EUVD-2026-57317?

Semaphore UI versions before 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 contain a privilege escalation vulnerability (CVE-2026-73293, CVSS 8.8) that allows authenticated project managers to…. A patch is available.

How to fix or mitigate EUVD-2026-57317?

Within 24 hours, identify all Semaphore UI deployments and confirm whether any are running affected versions prior to 2.18.19 or between 2.19.0-alpha3 and 2.19.5-beta5; audit all project manager role assignments and review custom role creation API logs for suspicious activity. Within 7 days, restrict project manager role grants to only trusted administrators, implement network-level rate limiting on the custom role creation endpoint, and enable detailed audit logging of all role and permission modifications. Within 30 days, monitor Semaphore project advisories for patch releases and prepare to upgrade to version 2.18.19+ or 2.19.5+ final when available. No vendor-released patch identified at time of analysis-maintain compensating controls until patched.

Semaphore UI EUVD-2026-57317

| CVE-2026-73293 HIGH

Improper Privilege Management (CWE-269)

2026-08-12 GitHub_M

Privilege Escalation Semaphore

8.8

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible API exploitable with only a project manager session (PR:L); no configuration prerequisite; full project owner takeover yields C:H/I:H/A:H against project resources.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 12, 2026 - 17:17 EUVD

Source Code Evidence Fetched

Aug 12, 2026 - 16:22 vuln.today

Analysis Generated

Aug 12, 2026 - 16:22 vuln.today

CVE Published

Aug 12, 2026 - 15:45 cve.org

HIGH 8.8

DescriptionCVE.org

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

AnalysisAI

Privilege escalation in Semaphore UI allows an authenticated project manager to gain owner-level project control by exploiting a role-shadowing flaw in the custom role creation API. Affected versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5 permit a project manager to POST a custom role with a slug matching a built-in role name and bitmask 15, causing the middleware to resolve the database-backed custom role instead of the protected built-in, thereby granting CanUpdateProject and CanManageProjectUsers capabilities reserved for owners. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain or compromise project manager credentials

Delivery

Authenticate to Semaphore UI REST API

Exploit

POST /api/project/{id}/roles with built-in slug and bitmask 15

Execution

Database custom role shadows built-in manager in middleware lookup

Persist

Acquire CanUpdateProject and CanManageProjectUsers owner capabilities

Impact

Modify project settings or manage user membership as owner

Access

Obtain or compromise project manager credentials

Delivery

Authenticate to Semaphore UI REST API

Exploit

POST /api/project/{id}/roles with built-in slug and bitmask 15

Execution

Database custom role shadows built-in manager in middleware lookup

Persist

Acquire CanUpdateProject and CanManageProjectUsers owner capabilities

Impact

Modify project settings or manage user membership as owner

Vulnerability AssessmentAI

Exploitation	Exploitation requires an active authenticated session holding the project manager role within the targeted Semaphore UI project - the CVSS PR:L vector confirms low-privilege authentication is the minimum entry bar. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 rating (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately represents the threat model: a single authenticated API call with no prerequisites beyond holding a project manager role is sufficient to escalate to owner-level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker authenticated to a vulnerable Semaphore instance as a project manager sends a POST request to /api/project/{project_id}/roles with JSON body specifying slug='manager' and permissions=15. The unpatched ProjectMiddleware resolves this custom database role instead of the built-in manager definition, and the attacker's session is now treated as carrying CanUpdateProject and CanManageProjectUsers - capabilities reserved for project owners. …
Remediation	Upgrade to Semaphore UI v2.18.19 (stable) or v2.19.5-beta5 (pre-release), as confirmed by the release tags at https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19 and https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all Semaphore UI deployments and confirm whether any are running affected versions prior to 2.18.19 or between 2.19.0-alpha3 and 2.19.5-beta5; audit all project manager role assignments and review custom role creation API logs for suspicious activity. …

Threat intelligence, references, and detailed analysis are available after sign-in.