CVE-2026-73682

This CVE reveals a structural flaw in how Semaphore handles git operations: project-scoped RBAC permissions don't prevent infrastructure-level command execution. The --upload-pack injection in git_url processing sits at a shared infrastructure layer rather than within project sandboxes, meaning any user with Manager or Owner role on any project can reach host-level RCE. The permission model is working exactly as designed—it's just designed around assumptions that became false when multi-tenant deployments became the norm. Originally, 'authenticated user' meant a trusted internal developer. Now it means a user with project-level access in a shared SaaS environment, but the git_url execution path never got re-audited against that shifted threat model. The CVSS 8.8 captures severity but obscures the actual exploitability constraints: this isn't a remotely exploitable flaw without authentication, and the population of users who can trigger it (project Managers/Owners) is typically smaller and more vetted than generic 'authenticated users.' That doesn't excuse the flaw—it suggests our severity metrics for CI/CD argument injection may be systematically miscalibrated. The fix isn't just sanitizing git_url input. The real question is whether project-scoped roles should ever have direct paths to host-level execution on shared infrastructure, or whether that access should require explicit infrastructure-admin separation. The --upload-pack injection pattern has been documented across CI/CD systems since at least 2017, yet each vendor patches at their own layer without architectural knowledge transfer. This isn't just accumulated technical debt—it's compounding exposure where each new CVE in this class teaches attackers the pattern. The remediation that matters is treating git_url processing as a security-critical, continuously-audited code path going forward, not just patching this specific injection vector.

Reviewed through automated stages and approved by a human before publication.