Semaphore UI is a web interface for managing DevOps tools. The vulnerability allows a project manager to create a custom role that inherits manager permissions but also grants owner‑level capabilities, such as updating project settings and managing project users. By exploiting this role‑slug collision, an attacker can increase privileges from manager to owner, effectively bypassing the intended access controls. The weakness falls under CWE‑269, which describes privilege escalation due to improper authorization checks.

The affected product is Semaphore UI. Versions before 2.18.19 and the release series from 2.19.0‑alpha3 through 2.19.5‑beta5 are vulnerable. All other releases, including 2.18.19 and 2.19.5‑beta5 and later, contain the fix.

The CVSS score of 8.8 indicates a high‑severity flaw. Exploitation is achieved via the public HTTP REST endpoint POST /api/project/{id}/roles and requires only manager‑level credentials, a common role in many projects. No EPSS data is available, but the magnitude of the privilege change and the lack of mitigation in the affected releases suggest that exploitation is reasonably likely. The vulnerability is not currently listed in CISA’s KEV catalog, yet its high severity and straightforward attack path merit immediate attention.