HIGHCVSS 8.8EPSS 0.4%

CVE-2026-73293

CVE-2026-73293 updated by NVD

Published: 2026-09-03
Modified: 2026-09-11
EPSS percentile: 33%
Sources: github-advisory, nvd

Summary

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/semaphoreui/semaphore	—	0.0.0-20260705182501-bb2a4e1f08c8

Remediation: Upgrade to 0.0.0-20260705182501-bb2a4e1f08c8 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73293

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.