Semaphore UI: Manager-to-owner privilege escalation via custom-role slug collision
Semaphore resolves a project member's effective permissions in ProjectMiddleware by looking up a role row whose slug matches the member's assigned role, and overwrites the built-in permission bitmask with that row's value. A member holding the built-in manager role creates a custom project role through POST /api/project/{id}/roles, a route gated only by the CanManageProjectResources permission that manager already holds. The role-creation validator does not reserve the built-in slug names (owner, …