Unleash: Missing await on permission check + cross-project IDOR in admin API
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.
Summary
Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unleash | unleash | before 8.0.3 | 8.0.3 | Patch available | CNA |
| — | unleash-server (npm) | before 8.0.3 | 8.0.3 | Patch available | GHSA-72h8-wp98-7hch |
- unleash VendorUnleash Affected before 8.0.3 Fixed in 8.0.3 Patch available CNA
- unleash-server (npm) Vendor— Affected before 8.0.3 Fixed in 8.0.3 Patch available GHSA-72h8-wp98-7hch
Remediation
- Fix · CNA unleash (Unleash) Fixed in 8.0.3
- Fix · GHSA-72h8-wp98-7hch unleash-server (npm) Fixed in 8.0.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77426
- 2026-10-03 Alias added: GHSA-72h8-wp98-7hch
References
Other 8
- https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch
- https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a
- https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1
- https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d
- https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a
- https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef
- https://github.com/Unleash/unleash/releases/tag/v8.0.3
- https://github.com/Unleash/unleash
More Unleash vulnerabilities
- TI-2026-45230 Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter CVSS 3.1HIGH 7.5
- TI-2026-45005 Server-side request forgery in unleash CVSS 3.1MEDIUM 5.5
- TI-2026-53733 Unleash: Clone-feature lets a user copy a feature from a project they cannot read CVSS 4.0MEDIUM 5.3
- TI-2026-54010 Authorization bypass in unleash CVSS 3.1MEDIUM 4.3
- TI-2026-45232 Improper output encoding in unleash CVSS 3.1MEDIUM 4.1
- TI-2026-53732 Unleash: CR-approval email renders user-controlled raw HTML CVSS 4.0LOW 2.1
Sources
- CVE-2026-77426 · CVE Program
- CVE-2026-77426 · NVD
- FIRST EPSS
- GHSA-72h8-wp98-7hch · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences