CVE-2026-77426

Received Received - Intake

Authorization Bypass in Unleash Feature Management Platform

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-22

Last Modified

2026-09-22

Generated

2026-09-23

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-77426

Affected Vendors & Products

Vendor	Product	Version / Range
unleash	unleash	8.0.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Unleash open-source feature management platform before version 8.0.3. It involves five authorization flaws in the admin API that allow authenticated users to perform unauthorized actions such as modifying segment assignments, disclosing variant configurations across projects, and changing tags without proper permissions.

Impact Analysis

An attacker with access could exploit these flaws to alter feature configurations, view sensitive data across projects, or modify tags without authorization. This could lead to unauthorized changes in application behavior or data exposure.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) by exposing or altering protected information without consent.

Mitigation Strategies

Upgrade Unleash to version 8.0.3 or later to address the authorization vulnerabilities in the admin API.

Hi! I’m here to help you understand CVE-2026-77426. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70