{"id":"CVE-2026-77426","aliases":["EUVD-2026-84867","GHSA-72h8-wp98-7hch"],"status":"published","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.","severity":{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00484,"percentile":0.42003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-639","CWE-862"],"published":"2026-09-22T20:31:36Z","modified":"2026-10-28T02:31:02Z","fixes":[{"ecosystem":"npm","package":"unleash-server","fixed_in":["8.0.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"unleash-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"unleash-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.3"}]}]}],"products":[{"vendor":"unleash","product":"unleash"}],"references":[{"url":"https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-72h8-wp98-7hch"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77426.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77426","tags":["advisory"]},{"url":"https://github.com/Unleash/unleash","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77426","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.","status":"published","published":"2026-09-22T20:31:36.749Z","modified":"2026-09-23T15:07:08.906Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-84867","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.","status":"published","published":"2026-09-22T20:31:36Z","modified":"2026-09-23T15:07:08Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T17:28:00.617613Z"}],"ghsa":[{"id":"GHSA-72h8-wp98-7hch","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","description":"## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src/lib/features/segment/segment-controller.ts` (line 345)\n\n`POST /api/admin/segments/strategies` has `permission: NONE` at the route level. The handler performs its own check via `this.accessService.hasPermission()`, but **omits the `await` keyword**. Since `hasPermission()` is async (returns `Promise\u003cboolean\u003e`), the variable always receives a truthy Promise object. The `if (!hasFeatureStrategyPermission)` check never triggers.\n\n```typescript\n// BUG: missing await - hasPermission() returns Promise\u003cboolean\u003e\nconst hasFeatureStrategyPermission = this.accessService.hasPermission(\n    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,\n);\nif (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!\n    res.status(403).send();\n    return;\n}\n```\n\n**Impact:** Any authenticated user can modify segment assignments on ANY strategy across ALL projects.\n\n**Fix:** Add `await`: `const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)`\n\n## Vulnerability 2: Cross-Project Variant Read (MEDIUM)\n\n**File:** `src/lib/routes/admin-api/project/variants.ts` (line 213-223)\n\n`GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants` completely ignores `projectId`. `getVariantsOnEnv()` only uses `featureName` and `environment`.\n\n**Impact:** Any authenticated user can read variant configs (names, weights, payloads) from any project.\n\n## Vulnerability 3: Cross-Project Strategy Read (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 1107-1116)\n\n`GET .../strategies/:strategyId` ignores all params except `strategyId`. Any authenticated user can read any strategy's full configuration.\n\n## Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-service.ts` (line 1611)\n\n`getEnvironmentInfo()` doesn't validate feature belongs to project. Compare with `getFeature()` which calls `validateFeatureBelongsToProject()`.\n\n## Vulnerability 5: Cross-Project Tag Modification (LOW)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 576-596)\n\n`PUT /:projectId/tags` accepts features array in body without validating they belong to projectId.","status":"published","published":"2026-09-22T20:36:42Z","modified":"2026-09-22T20:36:48Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:41:20.575159Z"}],"nvd":[{"id":"CVE-2026-77426","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.","status":"published","published":"2026-09-22T21:17:32.327Z","modified":"2026-09-23T18:12:04.247Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T14:12:50.703874Z"}],"osv":[{"id":"CVE-2026-77426","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","description":"Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.","status":"published","published":"2026-09-22T20:31:36.749Z","modified":"2026-10-28T02:31:02.190582307Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"GHSA-72h8-wp98-7hch","title":"Unleash: Missing await on permission check + cross-project IDOR in admin API","description":"## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src/lib/features/segment/segment-controller.ts` (line 345)\n\n`POST /api/admin/segments/strategies` has `permission: NONE` at the route level. The handler performs its own check via `this.accessService.hasPermission()`, but **omits the `await` keyword**. Since `hasPermission()` is async (returns `Promise\u003cboolean\u003e`), the variable always receives a truthy Promise object. The `if (!hasFeatureStrategyPermission)` check never triggers.\n\n```typescript\n// BUG: missing await - hasPermission() returns Promise\u003cboolean\u003e\nconst hasFeatureStrategyPermission = this.accessService.hasPermission(\n    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,\n);\nif (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!\n    res.status(403).send();\n    return;\n}\n```\n\n**Impact:** Any authenticated user can modify segment assignments on ANY strategy across ALL projects.\n\n**Fix:** Add `await`: `const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)`\n\n## Vulnerability 2: Cross-Project Variant Read (MEDIUM)\n\n**File:** `src/lib/routes/admin-api/project/variants.ts` (line 213-223)\n\n`GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants` completely ignores `projectId`. `getVariantsOnEnv()` only uses `featureName` and `environment`.\n\n**Impact:** Any authenticated user can read variant configs (names, weights, payloads) from any project.\n\n## Vulnerability 3: Cross-Project Strategy Read (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 1107-1116)\n\n`GET .../strategies/:strategyId` ignores all params except `strategyId`. Any authenticated user can read any strategy's full configuration.\n\n## Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-service.ts` (line 1611)\n\n`getEnvironmentInfo()` doesn't validate feature belongs to project. Compare with `getFeature()` which calls `validateFeatureBelongsToProject()`.\n\n## Vulnerability 5: Cross-Project Tag Modification (LOW)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 576-596)\n\n`PUT /:projectId/tags` accepts features array in body without validating they belong to projectId.","status":"published","published":"2026-09-22T20:36:42Z","modified":"2026-09-22T21:00:05.644113072Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-639","CWE-862"],"updated_at":"2026-11-02T15:46:40.308826Z"}]}}