Privilege Escalation in Semaphore UI via Role Permission Override

Executive Summary

This vulnerability in Semaphore UI allows a project manager to create a custom role with a reserved slug like 'manager' and assign it the maximum permission bitmask (15). This overrides built-in manager permissions and grants owner-level capabilities such as updating projects or managing users. The issue occurs because the system does not validate role slugs properly, allowing custom roles to shadow built-in ones.

Useful 0 Not Useful 0

Detection Guidance

Check Semaphore UI versions with: docker inspect semaphoreui/semaphore --format='{{.Config.Image}}' or semaphore version. Vulnerable versions are <2.18.19 and 2.19.0-alpha3 to 2.19.5-beta5. Review logs for POST /api/project/{id}/roles requests creating roles with slug 'manager' and permission bitmask 15.

Useful 0 Not Useful 0

Impact Analysis

An attacker with manager access could escalate privileges to full owner status. This enables actions like changing project settings, deleting projects, or modifying project members. The vulnerability is exploitable with a single authenticated request and affects confidentiality, integrity, and availability of project data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a project manager to escalate privileges to full owner status by creating a custom role with a reserved slug like 'manager' and assigning it owner-equivalent permissions. This could lead to unauthorized access to sensitive project data, modification of settings, or deletion of projects, which may violate compliance requirements for data protection and access control in standards like GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Semaphore UI to version 2.18.19 or 2.19.5-beta5 or later immediately. Remove any custom roles with slugs matching built-in roles like 'manager'. Audit all project roles and permissions for unauthorized privilege escalations.

Useful 0 Not Useful 0