Semaphore Privilege Escalation: Manager to Owner via Custom-Role Slug Collision

Vulnerability Overview Vulnerability Name: Manager-to-owner privilege escalation via custom-role slug collision Description: Semaphore resolves effective permissions for project members in by looking up the role row whose slug matches the member's assigned role, thereby overriding the built-in role bitmasks. Members holding the built-in role can create custom roles via . This route is protected only by the permission, which already possesses. The role creation validator does not preserve built-in role names ( , , , ) and imposes no upper limit on permission bits. Consequently, a member with the role can create a role with full permission bits set to 15, including the two built-in role bits and , neither of which the role inherently holds. Since slug lookup overrides permission resolution and ignores built-in role bits, the effective permissions returned for the become equivalent to those of an owner. Impact: Project administrators can escalate to project owner status via a single authenticated request, allowing them to add or remove members, change project settings, delete the project, or downgrade the project owner. Scope of Impact Affected Versions: v2.18.12 (current latest as of 2026-09-06) and HEAD. Exploitability confirmed on v2.18.12 (commit ); the affected file remains unchanged on , with no fixing commits since that tag. Earlier releases may also be affected but have not been tested. Prerequisites: Requires a PRO build (custom project roles). The official Docker image has this feature enabled by default, requiring no subscription or configuration flags. Pure Community Builds: Unaffected, as custom project roles are not supported; the role creation endpoint returns 404. Remediation Patch Version: None available POC Code Additional Information CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: High - Integrity: High - Availability: High CVE ID: CVE-2026-7209 Weakness: CWE-359 Credit: Jan Kahmen, tuningpoint (jan@tuningpoint.de)

Goal Reached Thanks to every supporter — we hit 100%!

Semaphore Privilege Escalation: Manager to Owner via Custom-Role Slug Collision

More from this source