CVE-2026-76910

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to an authorization bypass in the cloneFeatureToggle function and the POST /api/admin/projects/:projectId/features/:featureName/clone endpoint. The root cause is that the system validates permissions for ...

CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

CVE-2026-76910: Authorization Bypass Through User-Controlled Key

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a...

PT-2026-97048

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description An issue exists where the system authorizes the creation of a feature in a destination project but fails to verify if the user has access to the source project. Since feature names are globally uniqu...