CVE-2026-57590 Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the authenticated user has permission to access the project associated with the target Task Group. This issue affects Apache DolphinScheduler: before...

CVE-2026-57590

A missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler (versions before 3.4.3 ). The root cause is that the affected APIs fail to verify if an authenticated user has the necessary permissions to access the project associated with the target Task Group. This...

CVE-2026-77426

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: Missing await on permission check + cross-project IDOR in admin API

Summary Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check. Vulnerability 1: Missing await on Permission Check HIGH File: src/lib/features/segment/segment-controller.ts line 345 POST...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Summary Unleash scopes write permissions per project and per environment: a user with the UPDATEFEATURESTRATEGY permission on project A is supposed to be able to mutate activation strategies only within project A. The endpoint POST...

CVE-2026-77426

The Unleash feature management platform (versions prior to 8.0.3 ) contains five authorization vulnerabilities in its admin API. A critical flaw in src/lib/features/segment/segment-controller.ts fails to await the hasPermission() call, allowing authenticated users to bypass permission checks and ...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

CVE-2026-77426 Unleash: Missing await on permission check + cross-project IDOR in admin API

Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authenticated users to modify segment assignmen...

EUVD-2026-84865

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-77425 Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

CVE-2026-77425

The open-source feature management platform Unleash (versions prior to 8.0.3 ) is vulnerable to a cross-project integrity write. The endpoint POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order fails to verify that the strategy IDs provide...

security-research

セキュリティリサーチ Apache Software Foundation に報告し、ASF セキュリティプロセスを通じて開示された脆弱性。15 プロジェクトにわたる 46 件の CVE 、2023 年から 2026 年。 公開された再現コードが存在する場合はリンクしている。いずれも問題を実証し、修正したリリースを明示する、最小限で自己完結したプロジェクトである。 25 種類の異なる CWE にわたり、2 つのクラスが支配的である: 信頼できないデータのデシリアライズ 7 件 と サーバーサイドリクエストフォージェリ 7 件。 Apache エコシステム全体: 16 件の CVE、14...

CVE-2026-93854

In OpenStack Blazar before 17.0.1 , the V2 lease API fails to enforce object-level authorization on update and delete operations due to a parameter name mismatch : the authorize() wrapper looks up the lease under the keyword "lease_id" while the controller methods name the parameter "id" (deliver...

GHSA-CJGJ-2FWF-4C2W Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

Perses's project query parameter authorization bypass exposes cross-project resources

Impact What kind of vulnerability is it? An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret or simply GET /api/v1/datasources?project=finance-secret and receives the full list of the finance-secret project's dashboar...

CVE-2026-63458 Perses project query parameter authorization bypass exposes cross-project resources

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

EUVD-2026-83266

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...