Cloudanix VulnDB

CVE-2026-77425

Medium · 4.3

CVSS

4.3

EPSS

0.3%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A permissions problem lets users who manage one set of features rearrange the order of features in other projects, which can change which features are turned on or off for end users.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing authorization checks on strategy IDs supplied to the set-sort-order endpoint allow an authenticated user to reorder strategies belonging to other projects, features, or environments.

Why it matters to the business

Attackers can alter the evaluation order of feature flags without modifying their definitions, potentially changing which features are enabled for users and undermining intended rollout or access controls.

How an attack unfolds

An authenticated user with update permissions in one project obtains strategy IDs from another project and submits them to the set-sort-order endpoint under their own authorized project context, causing the platform to reorder the foreign strategies and change evaluation precedence.

How to fix it

Upgrade to Unleash 8.0.3 or later; the update adds server-side verification that every supplied strategy ID belongs to the project, feature, and environment referenced in the request URL.

How to confirm the fix worked

After upgrade, attempt to submit foreign strategy IDs to the set-sort-order endpoint and confirm the request is rejected with an authorization error; review audit logs to ensure cross-context reordering attempts are no longer accepted.

Typical attack path

  1. Obtain valid session with UPDATE_FEATURE_STRATEGY permission in at least one project
  2. Discover strategy IDs belonging to a different project, feature, or environment
  3. Issue POST to /api/admin/projects/{own-project}/features/{own-feature}/environments/{own-env}/strategies/set-sort-order containing the foreign strategy IDs
  4. Observe successful sort-order change attributed to the attacker's context

How to detect it

Search application audit or access logs for POST requests to the set-sort-order endpoint that reference strategy IDs not present in the project or feature named in the URL path; look for successful 2xx responses on such requests.

What your security team should do

  • Immediately upgrade all instances to version 8.0.3 or newer
  • Review role assignments to ensure UPDATE_FEATURE_STRATEGY is granted only to trusted users
  • Enable audit logging for the set-sort-order endpoint and monitor for unexpected reorder operations
  • Test feature flag evaluation order in staging environments that mirror production project structures

The record

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifying that the IDs belong to the project, feature, and environment authorized by the URL. In a multi-project Pro or Enterprise deployment, an authenticated user with UPDATE_FEATURE_STRATEGY in one project who knows another project's strategy IDs can reorder those strategies, changing feature evaluation precedence while the operation is attributed to the attacker's URL context rather than the affected project. The single-project OSS edition lacks the cross-project dimension, although the missing context binding still permits unauthorized reordering across features or environments in the default project. The endpoint changes only sort_order and does not modify strategy parameters, constraints, or segments. This issue is fixed in version 8.0.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities