CVE-2026-73293
- Source
- https://cve.org/CVERecord?id=CVE-2026-73293
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-73293.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-73293
- Aliases
- Downstream
openSUSE (1)
- Related
- Published
- 2026-08-12T15:45:22Z
- Modified
- 2026-10-22T10:31:32Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
- Details
-
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-269" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73293.json" }- References
-
- https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19
- https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73293.json
- https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2
- https://nvd.nist.gov/vuln/detail/CVE-2026-73293
- https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68
- https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb
Affected packages
Git / github.com/semaphoreui/semaphore
Affected ranges
- Type
- GIT
- Repo
- https://github.com/semaphoreui/semaphore
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedIntroducedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "2.18.19" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "2.19.0-alpha3" }, { "fixed": "2.19.5-beta5" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "1c4bb65df114962134f8829d4a03667106a01a68" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v2.18.19", "range": [ { "fixed": "1c4bb65df114962134f8829d4a03667106a01a68" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v2.19.5-beta5", "range": [ { "fixed": "3160e3d8f66673ae40baba126d4e25420ad9ce0a" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
2.*
2.0-beta
v2.*
v2.0
v2.0-alpha
v2.0-beta
v2.0-beta-2
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.10.1-beta
v2.10.11
v2.10.12-beta
v2.10.13-beta
v2.10.14-beta
v2.10.15-beta
v2.10.16-beta
v2.10.17-beta
v2.10.18
v2.10.19
v2.10.2
v2.10.20
v2.10.22
v2.10.23-beta
v2.10.24-beta
v2.10.26-beta
v2.10.27
v2.10.28
v2.10.29
v2.10.3-beta
v2.10.30
v2.10.31
v2.10.32
v2.10.33
v2.10.34
v2.10.35
v2.10.4-beta
v2.10.42
v2.10.43
v2.10.5-beta
v2.10.6-beta
v2.10.7
v2.10.8-beta
v2.10.9-beta
v2.11.0-beta1
v2.11.0-beta2
v2.11.0-beta3
v2.11.0-beta4
v2.11.0-beta5
v2.11.0-beta6
v2.11.0-beta7
v2.11.0-beta8
v2.11.0-beta9
v2.11.0-rc1
v2.11.1
v2.12.0
v2.12.0-beta1
v2.12.0-beta2
v2.12.0-beta3
v2.12.0-beta8
v2.12.0-beta9
v2.12.1
v2.12.10
v2.12.11
v2.12.12
v2.12.13
v2.12.14
v2.12.17
v2.12.2
v2.12.3
v2.12.4
v2.12.5
v2.12.6
v2.12.7
v2.12.8
v2.12.9
v2.13.0
v2.13.0-beta1
v2.13.0-beta2
v2.13.0-beta3
v2.13.0-beta4
v2.13.0-beta5
v2.13.0-beta6
v2.13.1
v2.13.2
v2.13.6
v2.14.0-beta1
v2.14.0-beta2
v2.14.0-beta3
v2.14.0-beta4
v2.14.0-beta5
v2.14.0-rc1
v2.15.0
v2.15.0-beta1
v2.15.0-beta4
v2.15.0-beta5
v2.16.0-beta1
v2.16.0-beta2
v2.16.0-beta3
v2.16.0-beta4
v2.16.0-beta5
v2.16.0-beta6
v2.16.0-beta7
v2.16.0-beta8
v2.16.0-beta9
v2.16.1
v2.16.10
v2.16.11
v2.16.12
v2.16.13
v2.16.14
v2.16.16
v2.16.17
v2.16.18
v2.16.2
v2.16.4
v2.16.5
v2.16.7
v2.17.0-beta1
v2.17.0-beta14
v2.17.0-beta15
v2.17.0-beta16
v2.17.0-beta17
v2.17.0-beta18
v2.17.0-beta19
v2.17.0-beta2
v2.17.0-beta20
v2.17.0-beta21
v2.17.0-beta22
v2.17.0-beta23
v2.17.0-rc10
v2.17.0-rc4
v2.17.0-rc5
v2.17.0-rc6
v2.17.0-rc7
v2.17.0-rc8
v2.17.16
v2.17.17
v2.17.19
v2.17.20
v2.17.21
v2.17.23
v2.17.24
v2.17.25
v2.17.26
v2.17.32
v2.18.0-beta1
v2.18.0-beta10
v2.18.0-beta11
v2.18.0-beta12
v2.18.0-beta13
v2.18.0-beta14
v2.18.0-beta17
v2.18.0-beta18
v2.18.0-beta2
v2.18.0-beta20
v2.18.0-beta21
v2.18.0-beta3
v2.18.0-rc1
v2.18.0-rc2
v2.18.1
v2.18.10
v2.18.12
v2.18.13
v2.18.14
v2.18.15
v2.18.16
v2.18.17
v2.18.18
v2.18.2
v2.18.3
v2.18.4
v2.18.5
v2.18.6
v2.18.7
v2.18.8
v2.18.9
v2.19.0-beta1
v2.19.0-beta2
v2.19.0-beta3
v2.19.4-beta1
v2.19.4-beta5
v2.19.4-beta6
v2.19.4-beta7
v2.19.4-beta8
v2.19.4-beta9
v2.19.5-beta1
v2.19.5-beta2
v2.19.5-beta3
v2.19.5-beta4
v2.2.0
v2.3.0
v2.4.0
v2.4.1
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.6.7
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.12
v2.7.13
v2.7.14
v2.7.15
v2.7.16
v2.7.2
v2.7.22
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.10
v2.8.11
v2.8.12
v2.8.13
v2.8.14
v2.8.15
v2.8.16
v2.8.17
v2.8.19
v2.8.2
v2.8.20
v2.8.21
v2.8.22
v2.8.23
v2.8.24
v2.8.25
v2.8.26
v2.8.27
v2.8.28
v2.8.29
v2.8.3
v2.8.30
v2.8.31
v2.8.32
v2.8.33
v2.8.34
v2.8.35
v2.8.37
v2.8.39
v2.8.4
v2.8.40
v2.8.41
v2.8.42
v2.8.43
v2.8.44
v2.8.45
v2.8.46
v2.8.47
v2.8.48
v2.8.49
v2.8.5
v2.8.50
v2.8.51
v2.8.53
v2.8.54
v2.8.55
v2.8.6
v2.8.60
v2.8.62
v2.8.63
v2.8.64
v2.8.65
v2.8.75
v2.8.76
v2.8.77
v2.8.8
v2.8.80
v2.8.81
v2.8.82
v2.8.83
v2.8.84
v2.8.85
v2.8.86
v2.8.87
v2.8.88
v2.8.89
v2.8.9
v2.8.90
v2.8.91
v2.8.92
v2.8.94
v2.8.95
v2.9.0
v2.9.1
v2.9.10
v2.9.100-beta
v2.9.102-beta
v2.9.103-beta
v2.9.104-beta
v2.9.108-beta
v2.9.109
v2.9.11
v2.9.110-beta
v2.9.111-beta
v2.9.112
v2.9.113-beta
v2.9.12
v2.9.13-beta
v2.9.14
v2.9.15
v2.9.16
v2.9.17
v2.9.18
v2.9.19
v2.9.2
v2.9.20
v2.9.21
v2.9.22
v2.9.23
v2.9.24
v2.9.25
v2.9.26
v2.9.27
v2.9.28
v2.9.29
v2.9.30
v2.9.31
v2.9.32
v2.9.33
v2.9.34
v2.9.35
v2.9.36
v2.9.37
v2.9.38-beta
v2.9.39-beta
v2.9.4
v2.9.40-beta
v2.9.41-beta
v2.9.42-beta
v2.9.43-beta
v2.9.44
v2.9.45
v2.9.46-beta
v2.9.47-beta
v2.9.48-beta
v2.9.49-beta
v2.9.5
v2.9.50-beta
v2.9.51-beta
v2.9.52-beta
v2.9.53-beta
v2.9.54-beta
v2.9.55-beta
v2.9.56
v2.9.57
v2.9.58
v2.9.6
v2.9.64
v2.9.65-beta
v2.9.66-beta
v2.9.67-beta
v2.9.68-beta
v2.9.69-beta
v2.9.7
v2.9.70
v2.9.74
v2.9.75
v2.9.8
v2.9.90-beta
v2.9.91-beta
v2.9.92-beta
v2.9.93-beta
v2.9.98-beta
v2.9.99-beta