CVE-2026-73293 Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
A project manager can escalate privileges to owner level by creating a custom role with specific permissions, bypassing intended access controls.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73293?
CVE-2026-73293 is a high-severity vulnerability in semaphoreui semaphore, published on 12 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.
Weakness: CWE-269
Which versions are affected by CVE-2026-73293?
3 open source packages ship an affected version, including github.com/semaphoreui/semaphore.
| Package | Affected | Fixed in |
|---|---|---|
github.com/semaphoreui/semaphore Go | All versions | 0.0.0-20260705182501-bb2a4e1f08c8 |
github.com/semaphoreui/semaphore Go | All versions | 0.0.0-20260705182501-bb2a4e1f08c8 |
github.com/semaphoreui/semaphore Go | All versions | 0.0.0-20260705182501-bb2a4e1f08c8 |
How do I fix CVE-2026-73293?
Upgrade github.com/semaphoreui/semaphore to 0.0.0-20260705182501-bb2a4e1f08c8 or later.
Is CVE-2026-73293 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73293 exists.
Sources
Also known as GHSA-cxvf-gvfq-36w2, GO-2026-6371.