{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3asemaphoreuisemaphore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.3,"id":"CVE-2026-73292"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semaphore UI (\u003c 0.0.0-20260707190631-c59c3dc9035b)"],"_cs_severities":["medium"],"_cs_tags":["web-vulnerability","csrf","account-takeover"],"_cs_type":"advisory","_cs_vendors":["Semaphore UI"],"content_html":"\u003cp\u003eSemaphore UI, an open-source automation platform, contains a critical Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-73292) identified in versions prior to 0.0.0-20260707190631-c59c3dc9035b. The vulnerability stems from the password change endpoint (/api/users/\u0026lt;id\u0026gt;/password) failing to enforce CSRF tokens or require re-authentication via a current password. Additionally, session cookies lack 'SameSite' attribute enforcement, facilitating cross-origin request abuse. By tricking an authenticated user into visiting a crafted malicious page, an attacker can silently execute a password change request. This allows for full account takeover, including the administrative account, depending on the targeted user's privileges. Defenders should prioritize patching, as this vulnerability requires minimal user interaction and leads to complete platform compromise.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the takeover of the targeted user's account. Because this vulnerability allows an attacker to change the administrator's password, it can lead to full administrative compromise of the Semaphore UI instance, enabling an attacker to manipulate projects, run arbitrary automation tasks, and potentially escalate access within the organization's infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade Semaphore UI to the latest patched version (\u0026gt;= 0.0.0-20260707190631-c59c3dc9035b) immediately to remediate CVE-2026-73292.\u003c/li\u003e\n\u003cli\u003eImplement global 'SameSite=Strict' or 'SameSite=Lax' cookie policies via load balancers or WAFs if immediate patching is not feasible.\u003c/li\u003e\n\u003cli\u003eReview audit logs for suspicious password change events occurring from unexpected IP addresses or anomalous User-Agent strings.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-04T00:07:25Z","date_published":"2026-09-04T00:07:25Z","id":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/","summary":"Semaphore UI is vulnerable to a CSRF attack via the password change endpoint, enabling unauthenticated attackers to hijack user accounts, including administrator accounts, by inducing an authenticated user to visit a malicious webpage.","title":"Semaphore UI Cross-Site Request Forgery Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-ui-csrf/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-73293"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semaphore (\u003c 0.0.0-20260705182501-bb2a4e1f08c8)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Semaphore"],"content_html":"\u003cp\u003eSemaphore UI, a web-based automation platform, contains a critical privilege escalation vulnerability (CVE-2026-73293) in its custom project role management feature. A project member assigned the 'manager' role can escalate their privileges to those of a project owner by exploiting a slug collision vulnerability during the custom role creation process. The application's \u003ccode\u003eProjectMiddleware\u003c/code\u003e incorrectly resolves effective permissions by prioritizing database role rows that match a user's assigned role slug. Because the API route \u003ccode\u003ePOST /api/project/{id}/roles\u003c/code\u003e does not reserve built-in slug names (such as 'manager' or 'owner') or enforce a permission ceiling, a manager can create a custom role with the slug 'manager' and set the permission bitmask to the value of an owner. This flaw allows a malicious project manager to gain administrative control over the project, including the ability to change project settings, modify other project members, or demote the legitimate project owner.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker is assigned the built-in 'manager' role within a target project.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the Semaphore UI and confirms their current restricted permission state via \u003ccode\u003eGET /api/project/{id}/role\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/project/{id}/roles\u003c/code\u003e containing a JSON payload with \u003ccode\u003eslug: \u0026quot;manager\u0026quot;\u003c/code\u003e and \u003ccode\u003epermissions: 15\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, creating a new role row in the database with the colliding slug 'manager' and the elevated permission bitmask.\u003c/li\u003e\n\u003cli\u003eOn the next API request, the \u003ccode\u003eProjectMiddleware\u003c/code\u003e executes \u003ccode\u003eGetProjectOrGlobalRoleBySlug\u003c/code\u003e, which fetches the attacker-created role row.\u003c/li\u003e\n\u003cli\u003eThe application overwrites the manager's effective permission bitmask with the elevated value from the database row.\u003c/li\u003e\n\u003cli\u003eThe attacker performs previously unauthorized actions, such as \u003ccode\u003ePUT /api/project/{id}\u003c/code\u003e to modify project settings or \u003ccode\u003ePOST /api/project/{id}/users\u003c/code\u003e to alter member access levels.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a project manager to effectively act as a project owner. This results in complete control over project resources, unauthorized access to sensitive project settings, the ability to remove or demote other users, and the potential for project deletion. This vulnerability affects instances utilizing the PRO build of Semaphore UI where custom project roles are active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate Semaphore UI to version 0.0.0-20260705182501-bb2a4e1f08c8 or later to resolve CVE-2026-73293. For current deployments, monitor web server logs for \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/project/*/roles\u003c/code\u003e from users with the 'manager' role that attempt to define reserved slugs such as 'manager', 'owner', 'task_runner', or 'guest'.\u003c/p\u003e\n","date_modified":"2026-09-04T00:07:18Z","date_published":"2026-09-04T00:07:18Z","id":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/","summary":"Semaphore UI is vulnerable to a privilege escalation where a project manager can create a colliding custom role slug to assign themselves owner-level permissions, bypassing access controls.","title":"Semaphore UI Privilege Escalation via Custom Role Slug Collision","url":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}