PT-2026-71144 · Unknown · Semaphore Ui

CVE-2026-73293

·

Published

2026-08-12

·

Updated

2026-09-10

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Semaphore UI versions prior to 2.18.19 Semaphore UI versions 2.19.0-alpha3 through 2.19.5-beta5
Description ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use the 'POST /api/project/{id}/roles' endpoint to create a custom manager role with a permission bitmask of 15. This action overrides built-in manager permissions and grants owner capabilities, specifically CanUpdateProject and CanManageProjectUsers.
Recommendations Update to version 2.18.19. Update to version 2.19.5-beta5.

Exploit

Fix

Improper Privilege Management

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-73293
GHSA-CXVF-GVFQ-36W2
GO-2026-6371

Affected Products

Semaphore Ui