CVE-2026-77425: Unleash Server Cross-Project Integrity Write Vulnerability
Summary
CVE-2026-77425: Unleash scopes write permissions per project and per environment: a user with the UPDATE_FEATURE_STRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. Affects unleash-server versions < 8.0.3. Fixed in 8.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Unleash is an open-source feature management platform that allows teams to manage feature flags and toggle features in their applications. It provides a way to control the rollout of features to users based on various strategies. The platform is designed to enhance development agility and improve user experience by enabling controlled feature releases. However, a vulnerability has been identified in version 8.0.0 of Unleash that allows low-privilege users to manipulate activation strategies across different projects, undermining the integrity of project permissions.
Vulnerability Detail
The vulnerability arises from the improper handling of authorization checks in the Unleash server's API endpoint for reordering feature strategies. Specifically, the endpoint allows a user with the 'UPDATE_FEATURE_STRATEGY' permission to reorder strategies not only in their own project but also in any other project. This is due to a lack of validation that the strategy IDs provided in the request body belong to the project specified in the URL. As a result, an attacker can alter the order of strategies for features in projects they do not have permission to access, potentially leading to unauthorized feature exposure or altered behavior in production environments. The vulnerability is classified with a CVSS score of 4.3, indicating a moderate severity level.
How To Fix
Minimum fixed version
8.0.3
This is the first release that contains the fix.
npm install unleash-server@8.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the API endpoint for reordering strategies to only those users who have explicit permissions for the target project. This can be done by implementing additional checks in the application code to verify that the strategy IDs in the request body match the project context specified in the URL.
Conclusion
The CVE-2026-77425 vulnerability in the Unleash server poses a significant risk by allowing unauthorized users to manipulate feature strategies across projects. It is crucial to update to version 8.0.3 or later to mitigate this risk and ensure proper authorization checks are in place. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for unleash-server →
FAQ
CVE-2026-77425 is a vulnerability in the Unleash server that allows low-privilege users to reorder feature strategies across different projects, bypassing project permissions.
You can use Vulert, which monitors open-source vulnerabilities in your software. By checking your package-lock.json file with Vulert's playground, you can determine if your application is affected by this vulnerability.
The vulnerability can lead to unauthorized changes in feature flag behavior, potentially exposing features to users who should not have access or altering the intended rollout of features.
Yes, a patch is available in version 8.0.3 of the Unleash server. It is recommended to update to this version to mitigate the vulnerability.
If an immediate update is not possible, implement additional access controls to restrict the API endpoint for reordering strategies to authorized users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for unleash-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
