# CVE-2026-73293: Semaphore UI privilege escalation via role-slug collision

Source: https://junglewise.ai/threats/cve-2026-73293-semaphore-ui-privilege-escalation-via-role-slug-collision  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73293 · Severity: high · CVSS 8.8 · Published 2026-08-12

Semaphore UI is an automation and project management platform that uses role-based access control to restrict what project members can do. A project manager can create a custom role with the same name as the built-in manager role and grant it owner-level permissions, allowing them to escalate to full project ownership in a single API request. An attacker can then modify project settings, manage members, delete the project, or remove the legitimate owner—actions normally restricted to project owners only.

Technologies: [github.com/semaphoreui/semaphore (Go)](https://junglewise.ai/threats/technologies/github-com-semaphoreui-semaphore), [SemaphoreUI Semaphore](https://junglewise.ai/threats/technologies/semaphore). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [SemaphoreUI](https://junglewise.ai/threats/vendors/semaphoreui).

## Quick answers

**Is CVE-2026-73293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73293 being exploited in the wild.

**How severe is CVE-2026-73293?** High severity, with a CVSS score of 8.8, published 12 August 2026.

**Which products and versions are affected?** github.com/semaphoreui/semaphore (Go) < 0.0.0-20260705182501-bb2a4e1f08c8, SEMVER:introduced=0,fixed=0.0.0-20260705182501-bb2a4e1f08c8; SemaphoreUI Semaphore < 0.0.0-20260705182501-bb2a4e1f08c8 (v2.18.12 confirmed; PRO build with custom roles).

**Is there a fix for CVE-2026-73293?** Yes. github.com/semaphoreui/semaphore (Go): upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73293 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-73293?** Check whether you run github.com/semaphoreui/semaphore (Go) or SemaphoreUI Semaphore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/semaphoreui/semaphore (Go): upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 or later

  ```sh
  go get github.com/semaphoreui/semaphore@v0.0.0-20260705182501-bb2a4e1f08c8
  ```


## Technical details

The vulnerability is a privilege escalation resulting from multiple validation gaps in Semaphore UI's custom role system. When a project member's effective permissions are resolved, the system looks up a role by slug (a unique identifier), and if a custom role exists with the same slug as the member's assigned role, it overwrites the member's permission bitmask with the custom role's permissions. The role-creation endpoint (`POST /api/project/{id}/roles`) is gated by the `CanManageProjectResources` permission, which the built-in `manager` role already holds. However, the role validator does not prevent creating a custom role with a reserved slug name (like `manager`, `owner`, `task_runner`, `guest`), nor does it cap the permission bits an attacker can assign. Additionally, the permission lookup ignores project scope, accepting any matching slug across projects. An authenticated manager creates a custom role with slug `manager` and all permission bits set (bitmask `15`), including the owner-only bits `CanUpdateProject` and `CanManageProjectUsers`. On the next request, the permission lookup returns the custom role row, granting the manager full owner privileges without requiring authentication changes or owner approval. Exploitation requires prior assignment to the project with manager role and is available only in the PRO build with custom project roles enabled (the default in official Docker images).

## Affected products

- semaphoreui semaphore < 0.0.0-20260705182501-bb2a4e1f08c8 (v2.18.12 confirmed; PRO build with custom roles)

## Identifiers

- CVE-2026-73293
- GHSA-cxvf-gvfq-36w2
- GO-2026-6371

## Timeline

- 2026-09-03: disclosed: GitHub Advisory published
- 2026-07-05: patched: Patch released in version 0.0.0-20260705182501-bb2a4e1f08c8
- 2026-08-12: advisory: NVD published CVE-2026-73293

## References

- [https://api.github.com/users/kah-ja](https://api.github.com/users/kah-ja)
- [https://github.com/kah-ja](https://github.com/kah-ja)
- [https://api.github.com/users/kah-ja/gists%7B/gist_id%7D](https://api.github.com/users/kah-ja/gists%7B/gist_id%7D)
- [https://api.github.com/users/kah-ja/repos](https://api.github.com/users/kah-ja/repos)
- [https://avatars.githubusercontent.com/u/36455663?v=4](https://avatars.githubusercontent.com/u/36455663?v=4)
- [https://api.github.com/users/kah-ja/events%7B/privacy%7D](https://api.github.com/users/kah-ja/events%7B/privacy%7D)

## Related threats

- [Semaphore UI OS command injection in git repository handling](https://junglewise.ai/threats/cve-2026-73294-semaphore-ui-os-command-injection-in-git-repository-handling)
- [Semaphore UI CSRF in password change endpoint](https://junglewise.ai/threats/cve-2026-73292-semaphore-ui-csrf-in-password-change-endpoint)