Description

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T16:17:22.493Z",
  "pubdate": "2026-08-12T16:17:22.493Z",
  "executiveSummary": "A privilege escalation vulnerability exists in Semaphore UI, a web interface for managing DevOps tools, affecting versions prior to 2.18.19 and from 2.19.0-alpha3 through 2.19.5-beta5.\nThe vulnerability arises from flawed authorization logic within the project role management functionality, specifically in ProjectMiddleware and GetProjectOrGlobalRoleBySlug.\nAn authenticated attacker possessing project manager privileges can exploit this flaw by issuing a crafted HTTP POST request to the /api/project/{id}/roles endpoint.\nThis allows the malicious project manager to create a custom manager role assigned a permission bitmask of 15.\nConsequently, the custom role overrides built-in manager permissions and improperly grants elevated owner capabilities, specifically CanUpdateProject and CanManageProjectUsers.\nThe risk implications include unauthorized administrative control over project configurations and user memberships by users who should otherwise be restricted to project-level management scope.\nSuccessful exploitation requires authenticated access with project manager privileges and network access to the Semaphore UI API.\nThe issue is successfully resolved in versions 2.18.19 and 2.19.5-beta5 through proper patch implementations.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation and access control enforcement within the role management subsystem of Semaphore UI, specifically inside ProjectMiddleware and the GetProjectOrGlobalRoleBySlug function.\nThe vulnerable components are responsible for parsing, validating, and establishing role permissions and boundaries within project scopes.\nThe affected versions include all releases prior to 2.18.19 and versions ranging from 2.19.0-alpha3 to 2.19.5-beta5.\nAuthentication and privilege requirements dictate that the actor must possess valid credentials and hold an existing project manager role to interact with the targeted API endpoint.\nThe network exposure encompasses any deployment where the Semaphore UI web interface and its underlying REST API are reachable by authenticated users.\nThe attack flow begins when an authenticated project manager targets the /api/project/{id}/roles HTTP POST endpoint.\nDuring this request, the attacker submits a payload designed to instantiate a custom manager role configured with a permission bitmask value of 15.\nBecause the server-side logic fails to adequately restrict role creation parameters and permission assignments, the application accepts the custom role creation request.\nThe newly created custom role successfully overrides the standard, built-in manager permissions defined by the application.\nThe permission bitmask 15 confers unintended owner-level capabilities to the attacker's custom role, explicitly granting CanUpdateProject and CanManageProjectUsers permissions.\nPost-exploitation impact includes unauthorized modification of project settings, infrastructure parameters, and the ability to provision, modify, or revoke user access rights at the project level, thereby breaching the intended principle of least privilege and administrative segmentation."
}