CVE-2026-73293: Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Semaphore resolves a project member’s effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member’s assigned role, and overwrites the built-in permission bitmask with that row’s value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds.

The role-creation validator does not reserve the built-in slug names (owner, manager, task_runner, guest) and sets no ceiling on the permission bits a caller may grant. A manager creates a role with slug manager carrying the full bitmask 15, including the two owner-only bits CanUpdateProject and CanManageProjectUsers that manager does not hold. The slug lookup that backs permission resolution ignores project scope, so this attacker-created row is returned on the next request and the manager’s effective permissions become owner-equivalent.

Result: a project manager escalates to full owner of the project with one authenticated request, then adds or removes members, changes project settings, deletes the project, or demotes the legitimate owner.