sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-77426 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-77426 Source advisory: MEND:CVE-2026-77426...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

EUVD-2026-84865

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-77425 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-77425 Source advisory: MEND:CVE-2026-77425...

CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-77425

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to a cross-project integrity write. The endpoint POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order fails to verify that the strategy IDs provide...

CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-76910 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-76910 Source advisory: MEND:CVE-2026-76910...

EUVD-2026-84863

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to an authorization bypass in the cloneFeatureToggle function and the POST /api/admin/projects/:projectId/features/:featureName/clone endpoint. The root cause is that the system validates permissions for ...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

EUVD-2026-84824

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-76909 Unleash: CR-approval email renders user-controlled raw HTML

Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML...

CVE-2026-76909

The open-source feature management platform Unleash is vulnerable to HTML injection in versions prior to 8.0.3 . The root cause is the use of Mustache triple-stash syntax (e.g., {{{ changeRequestTitle }}}) in the src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache template...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-76909 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-76909 Source advisory: MEND:CVE-2026-76909...