CVE-2026-102278 vulnerabilities

Vulnerabilities for packages: actions-runner, authentik-fips, authentik, commitizen, foxx-cli, tileserver-gl-fips, opensearch-dashboards, npm, opentelemetry-auto-instrumentations-node, ts-patch, unleash-fips, opensearch-dashboards-fips, lerna, pelias-api...

GHSA-QHR7-859C-M2P7 vulnerabilities

Vulnerabilities for packages: actions-runner, authentik-fips, authentik, commitizen, foxx-cli, tileserver-gl-fips, opensearch-dashboards, npm, opentelemetry-auto-instrumentations-node, ts-patch, unleash-fips, opensearch-dashboards-fips, lerna, pelias-api...

GHSA-Q2HR-2G5M-VWHR vulnerabilities

Vulnerabilities for packages: actions-runner, authentik-fips, authentik, commitizen, foxx-cli, tileserver-gl-fips, opensearch-dashboards, npm, opentelemetry-auto-instrumentations-node, ts-patch, unleash-fips, opensearch-dashboards-fips, lerna, pelias-api...

CVE-2026-102277 vulnerabilities

Vulnerabilities for packages: actions-runner, authentik-fips, authentik, commitizen, foxx-cli, tileserver-gl-fips, opensearch-dashboards, npm, opentelemetry-auto-instrumentations-node, ts-patch, unleash-fips, opensearch-dashboards-fips, lerna, pelias-api...

CVE-2026-76909

creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:20+00:00| published-proof-of-concept| https://github.com/Unleash/unleash/security/advisories/GHSA-7hvx-28gp-mf6j...

CVE-2026-76910

creationtimestamp| type| source ---|---|--- 2026-09-22 22:36:18+00:00| published-proof-of-concept| https://github.com/Unleash/unleash/security/advisories/GHSA-8xcj-9hfr-fh9j...

CVE-2026-77425

creationtimestamp| type| source ---|---|--- 2026-09-22 22:35:31+00:00| published-proof-of-concept| https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr...

CVE-2026-76910

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-77426

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77425

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-76909

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...

NPM: Unleash: Clone-feature lets a user copy a feature from a project they cannot read

NPM: Unleash: Clone-feature lets a user copy a feature from a project they cannot read vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with create permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. Th...

Unleash: CR-approval email renders user-controlled raw HTML

Summary The change-request approval HTML email template renders fields as raw HTML. User who can create a change request can inject HTML into approval notification emails. I was not able to confirm Enterprise platform is using vulnerable code nor that it doesn't sanitize input. Details...

NPM: Unleash: CR-approval email renders user-controlled raw HTML

NPM: Unleash: CR-approval email renders user-controlled raw HTML vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...