{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/semaphore--0.0.0-20260705182501-bb2a4e1f08c8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:semaphoreui:semaphore:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-73293"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Semaphore (\u003c 0.0.0-20260705182501-bb2a4e1f08c8)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Semaphore"],"content_html":"\u003cp\u003eSemaphore UI, a web-based automation platform, contains a critical privilege escalation vulnerability (CVE-2026-73293) in its custom project role management feature. A project member assigned the 'manager' role can escalate their privileges to those of a project owner by exploiting a slug collision vulnerability during the custom role creation process. The application's \u003ccode\u003eProjectMiddleware\u003c/code\u003e incorrectly resolves effective permissions by prioritizing database role rows that match a user's assigned role slug. Because the API route \u003ccode\u003ePOST /api/project/{id}/roles\u003c/code\u003e does not reserve built-in slug names (such as 'manager' or 'owner') or enforce a permission ceiling, a manager can create a custom role with the slug 'manager' and set the permission bitmask to the value of an owner. This flaw allows a malicious project manager to gain administrative control over the project, including the ability to change project settings, modify other project members, or demote the legitimate project owner.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker is assigned the built-in 'manager' role within a target project.\u003c/li\u003e\n\u003cli\u003eThe attacker authenticates to the Semaphore UI and confirms their current restricted permission state via \u003ccode\u003eGET /api/project/{id}/role\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a \u003ccode\u003ePOST\u003c/code\u003e request to \u003ccode\u003e/api/project/{id}/roles\u003c/code\u003e containing a JSON payload with \u003ccode\u003eslug: \u0026quot;manager\u0026quot;\u003c/code\u003e and \u003ccode\u003epermissions: 15\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application processes the request, creating a new role row in the database with the colliding slug 'manager' and the elevated permission bitmask.\u003c/li\u003e\n\u003cli\u003eOn the next API request, the \u003ccode\u003eProjectMiddleware\u003c/code\u003e executes \u003ccode\u003eGetProjectOrGlobalRoleBySlug\u003c/code\u003e, which fetches the attacker-created role row.\u003c/li\u003e\n\u003cli\u003eThe application overwrites the manager's effective permission bitmask with the elevated value from the database row.\u003c/li\u003e\n\u003cli\u003eThe attacker performs previously unauthorized actions, such as \u003ccode\u003ePUT /api/project/{id}\u003c/code\u003e to modify project settings or \u003ccode\u003ePOST /api/project/{id}/users\u003c/code\u003e to alter member access levels.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a project manager to effectively act as a project owner. This results in complete control over project resources, unauthorized access to sensitive project settings, the ability to remove or demote other users, and the potential for project deletion. This vulnerability affects instances utilizing the PRO build of Semaphore UI where custom project roles are active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate Semaphore UI to version 0.0.0-20260705182501-bb2a4e1f08c8 or later to resolve CVE-2026-73293. For current deployments, monitor web server logs for \u003ccode\u003ePOST\u003c/code\u003e requests to \u003ccode\u003e/api/project/*/roles\u003c/code\u003e from users with the 'manager' role that attempt to define reserved slugs such as 'manager', 'owner', 'task_runner', or 'guest'.\u003c/p\u003e\n","date_modified":"2026-09-04T00:07:18Z","date_published":"2026-09-04T00:07:18Z","id":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/","summary":"Semaphore UI is vulnerable to a privilege escalation where a project manager can create a colliding custom role slug to assign themselves owner-level permissions, bypassing access controls.","title":"Semaphore UI Privilege Escalation via Custom Role Slug Collision","url":"https://feed.craftedsignal.io/briefs/2026-09-semaphore-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Semaphore (\u003c 0.0.0-20260705182501-Bb2a4e1f08c8)","version":"https://jsonfeed.org/version/1.1"}