Cloudanix VulnDB

CVE-2026-76909

None

CVSS

—

EPSS

0.5%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

An attacker who can create feature change requests can slip hidden links or fake content into the approval emails that other team members receive.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Data Tampering
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Stored HTML injection in email notifications caused by unescaped rendering of user-supplied changeRequestTitle, requesterName, and requesterEmail values inside a Mustache template used for change-request approval messages.

Why it matters to the business

Attackers can embed arbitrary links, trackers, or misleading content inside legitimate approval emails, enabling phishing or social-engineering campaigns that target project approvers without requiring external infrastructure.

How an attack unfolds

An authenticated project member crafts a change request whose title, name, or email fields contain HTML payloads. When the approval workflow triggers an email and the template is rendered, the injected markup is delivered to approvers, allowing forged links or altered visual content to be displayed inside the message.

How to fix it

Upgrade Unleash to version 8.0.3 or later, which applies HTML escaping to the three affected template variables before Mustache rendering.

How to confirm the fix worked

Confirm the running version is at least 8.0.3; inspect the requested-cr-approval.mustache template to verify that changeRequestTitle, requesterName, and requesterEmail are now escaped; test by submitting a change request containing a benign HTML tag and verifying it appears encoded in the resulting email.

Typical attack path

  1. Obtain a low-privileged account that can create change requests
  2. Enable or wait for approval-email configuration to be active
  3. Submit a change request containing HTML markup in title, requester name, or requester email
  4. Trigger the approval notification so the email is generated and sent
  5. Recipient opens the email and interacts with the rendered malicious content

How to detect it

Search email logs and mail-server archives for change-request approval messages containing unexpected HTML tags, script elements, or URLs that do not match the legitimate Unleash domain; correlate with change-request creation events performed by non-admin accounts.

  • requested-cr-approval.html.mustache
  • sendRequestedCRApprovalEmail

What your security team should do

  • Immediately schedule upgrade to 8.0.3 across all instances
  • Temporarily disable change-request approval emails until patching is complete
  • Review recent change-request titles and requester fields for unexpected HTML
  • Add template-escape checks to internal code-review standards for future email templates

The record

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities