Cloudanix VulnDB

CVE-2026-77426

None

CVSS

—

EPSS

0.5%

Published

Sep 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the feature management system lets users with basic access change settings or view details belonging to other teams' projects, which could cause features to behave unexpectedly or leak internal configuration.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Multiple authorization bypasses in the Unleash admin API permit authenticated users to modify segment assignments without required permissions due to an unawaited promise, and to read or alter cross-project feature variants, strategies, environment info, and tags due to missing project/feature binding validations.

Why it matters to the business

Attackers with low-privileged accounts can change feature flag behavior or leak configuration details across projects, risking unintended feature exposure, configuration tampering, or loss of project isolation in production environments.

How an attack unfolds

An authenticated attacker sends crafted requests to the five vulnerable admin endpoints; the server either skips permission checks because of an unhandled promise or fails to enforce project boundaries, granting unauthorized modifications and cross-project data access without needing higher privileges.

How to fix it

Upgrade all Unleash instances to version 8.0.3 or later; after upgrade, audit existing segment, variant, strategy, and tag assignments for unauthorized cross-project entries.

How to confirm the fix worked

Confirm the running version is 8.0.3+, then replay the five affected admin API calls using identifiers from a second project while holding only permissions for the first project; each request must now return 403 or 404.

Typical attack path

  1. Obtain valid low-privileged API credentials
  2. Enumerate known project and feature identifiers via public or low-privilege calls
  3. Issue POST to /api/admin/segments/strategies or PUT to /:projectId/tags using identifiers from other projects
  4. Issue GET requests to variant, strategy, and environment info endpoints supplying foreign project identifiers
  5. Observe successful modifications or returned cross-project data confirming bypass

How to detect it

Search API gateway and application logs for successful responses to the five listed admin endpoints when the authenticated user lacks UPDATE_FEATURE_STRATEGY or the requested identifiers reference a different project than the one in the URL or token scope.

  • POST /api/admin/segments/strategies
  • GET /api/admin/projects/.*/features/.*/environments/.*/variants
  • GET /api/admin/.*/strategies/.*
  • PUT /.*/tags
  • getEnvironmentInfo cross-project feature access

What your security team should do

  • Immediately schedule upgrade to 8.0.3 across all instances
  • Enable detailed audit logging for all /api/admin/* endpoints
  • Review and tighten project-scoped RBAC rules post-upgrade
  • Scan historical logs for the listed admin paths originating from unexpected user or project contexts

The record

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignments without UPDATE_FEATURE_STRATEGY permission for the target project and environment. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, allowing cross-project variant configuration disclosure. GET .../strategies/:strategyId uses strategyId without validating the project and feature context, allowing cross-project strategy configuration disclosure. getEnvironmentInfo does not validate that the requested feature belongs to the supplied project, allowing cross-project environment information disclosure. PUT /:projectId/tags accepts feature identifiers without verifying that they belong to the URL project, allowing cross-project tag modification. This issue is fixed in version 8.0.3.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities