CyberRota Analysis
AI-GeneratedThe Semaphore UI is vulnerable in versions prior to 2.18.19 and between 2.19.0-alpha3 and 2.19.5-beta5, allowing project managers to exploit the API to create custom roles that grant excessive permissions, including the ability to update projects and manage users. This could lead to unauthorized access and control over project settings and user management. Organizations using affected versions should prioritize upgrading to the fixed versions to mitigate potential security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.19 and from 2.19.0-alpha3 until 2.19.5-beta5, ProjectMiddleware and GetProjectOrGlobalRoleBySlug allow a project manager to use POST /api/project/{id}/roles to create a custom manager role with permission bitmask 15, overriding the built-in manager permissions and granting CanUpdateProject and CanManageProjectUsers owner capabilities. This issue is fixed in versions 2.18.19 and 2.19.5-beta5.