Go/github.com/semaphoreui/semaphore CVE-2026-73293: high 8.8, EPSS 0.57%

Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision

Action: Upgrade github.com/semaphoreui/semaphore to 0.0.0-20260705182501-bb2a4e1f08c8 or later.

go get github.com/semaphoreui/semaphore@v0.0.0-20260705182501-bb2a4e1f08c8

Affected

Fixed versions

Sources

• osv: GHSA-cxvf-gvfq-36w2
• https://github.com/semaphoreui/semaphore/security/advisories/GHSA-cxvf-gvfq-36w2
• https://nvd.nist.gov/vuln/detail/CVE-2026-73293
• https://github.com/semaphoreui/semaphore/commit/1c4bb65df114962134f8829d4a03667106a01a68
• https://github.com/semaphoreui/semaphore/commit/bb2a4e1f08c8023e618f8dd6eaca73554f2c33bb
• https://github.com/semaphoreui/semaphore
• https://github.com/semaphoreui/semaphore/releases/tag/v2.18.19
• https://github.com/semaphoreui/semaphore/releases/tag/v2.19.5-beta5

CVE-2026-73293 · published 2026-09-03T19:23:42Z · modified 2026-09-10T15:25:39.766469356Z · JSON