CVE-2026-77426: Unleash Server Critical Permission Bypass and Cross-Project Data Exposure
Summary
CVE-2026-77426: Unleash: Missing await on permission check + cross-project IDOR in admin API. Affects unleash-server versions < 8.0.3. Fixed in 8.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Unleash is an open-source feature management platform that allows teams to control feature rollouts and manage feature flags effectively. It provides a robust admin API for managing features, strategies, and segments. However, recent vulnerabilities have been identified in the admin API that could lead to unauthorized access and modification of features across different projects.
Vulnerability Detail
The vulnerability arises from multiple authorization flaws in the Unleash admin API. The most critical issue is a missing 'await' on a permission check in the segment controller, which allows any authenticated user to modify segment assignments on any strategy across all projects. Additionally, there are cross-project data exposure vulnerabilities that permit users to read variant configurations, strategy details, and environment information from projects they do not own. These vulnerabilities stem from improper validation of user permissions and project associations.
How To Fix
Minimum fixed version
8.0.3
This is the first release that contains the fix.
npm install unleash-server@8.0.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your API routes to validate user permissions before allowing access to sensitive operations. For example, modify the permission check in the segment controller as follows:
const hasFeatureStrategyPermission = await this.accessService.hasPermission(
req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,
);
if (!hasFeatureStrategyPermission) {
res.status(403).send();
return;
}
Conclusion
The vulnerabilities identified in the Unleash server pose significant risks to application security, allowing unauthorized access and modifications across projects. It is crucial to update to the latest version and implement proper permission checks to safeguard your application.
See every vulnerability recorded for unleash-server →
FAQ
CVE-2026-77426 is a critical vulnerability in the Unleash server that allows unauthorized users to bypass permission checks and access or modify features across different projects.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities without requiring any signup.
The consequences include unauthorized modification of feature strategies, exposure of sensitive data across projects, and potential data leaks, which can compromise application security.
You can update the Unleash server package by running 'npm install unleash-server@8.0.3' in your project directory to ensure you have the latest patched version.
If you cannot update immediately, implement additional permission checks in your API routes to mitigate the risk of unauthorized access until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for unleash-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
