Cloudanix VulnDB

CVE-2026-76910

None

CVSS

—

EPSS

0.4%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A permissions problem let people copy hidden feature settings from one part of the system into another part they were allowed to use, potentially revealing internal business rules.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authorization bypass in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone that skips source project access checks, allowing any user with create/clone rights in a destination project to copy and read a globally unique feature's strategies, constraints, variants, and payloads from an unauthorized source project.

Why it matters to the business

Organizations using Unleash for feature flags risk unintended exposure of business logic, rollout strategies, and variant payloads across project boundaries, which can leak competitive or sensitive configuration details and complicate compliance or access governance.

How an attack unfolds

An attacker obtains create or clone permissions in at least one project, enumerates or guesses a feature name from another project, issues the clone API call to their authorized project, and then reads the copied feature's full configuration including constraints and variant payloads.

How to fix it

Upgrade all Unleash instances to version 8.0.3 or later, which enforces source-project authorization on clone operations. Review and tighten project-level create/clone permissions in the interim.

How to confirm the fix worked

Confirm deployment of version 8.0.3+, attempt cross-project clone operations with a low-privilege account to verify enforcement, and review audit logs for any prior unauthorized clone attempts.

Typical attack path

  1. Obtain create/clone permission in a destination project
  2. Discover or guess the name of a feature toggle in a different source project
  3. Call cloneFeatureToggle or POST /api/admin/projects/:projectId/features/:featureName/clone with the guessed source feature name
  4. Inspect the newly created copy to extract strategies, constraints, variants, and payloads

How to detect it

Search application and API access logs for successful POSTs to /api/admin/projects/*/features/*/clone where the caller lacks explicit source-project membership; correlate with subsequent feature-read or update events on the newly cloned toggle.

What your security team should do

  • Immediately schedule upgrade to Unleash 8.0.3 across all environments
  • Audit project permissions and revoke unnecessary create/clone rights
  • Enable or increase logging of clone API calls for at least 90 days
  • Add the clone endpoints to existing API abuse detection rules

The record

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities