CVE-2026-77425

Received Received - Intake

Unauthorized Strategy Reordering in Unleash

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifying that the IDs belong to the project, feature, and environment authorized by the URL. In a multi-project Pro or Enterprise deployment, an authenticated user with UPDATE_FEATURE_STRATEGY in one project who knows another project's strategy IDs can reorder those strategies, changing feature evaluation precedence while the operation is attributed to the attacker's URL context rather than the affected project. The single-project OSS edition lacks the cross-project dimension, although the missing context binding still permits unauthorized reordering across features or environments in the default project. The endpoint changes only sort_order and does not modify strategy parameters, constraints, or segments. This issue is fixed in version 8.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-77425

Affected Vendors & Products

Vendor	Product	Version / Range
unleash	unleash	8.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability in Unleash before version 8.0.3 allows an authenticated user with UPDATE_FEATURE_STRATEGY permissions in one project to reorder feature strategies in another project by manipulating strategy IDs. The issue occurs because the endpoint does not verify if the strategy IDs belong to the project, feature, or environment specified in the URL.

Detection Guidance

To detect this vulnerability, check if your Unleash instance is running a version prior to 8.0.3. Verify the API endpoint POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order for improper authorization checks. Monitor logs for unauthorized reordering of strategies across projects or environments.

Impact Analysis

An attacker could change the evaluation order of feature flags, potentially enabling unauthorized access or disrupting intended functionality. This could lead to incorrect feature behavior or privilege escalation in multi-project deployments.

Compliance Impact

This vulnerability allows unauthorized reordering of feature strategies in multi-project deployments, which could lead to incorrect feature flag evaluations. While it does not directly expose sensitive data, it may enable privilege escalation or misconfiguration that could violate compliance requirements for data integrity and access control in standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Unleash to version 8.0.3 or later to address the vulnerability. Ensure no unauthorized users have UPDATE_FEATURE_STRATEGY permissions in multi-project deployments.

Hi! I’m here to help you understand CVE-2026-77425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70