PT-2026-67256

Name of the Vulnerable Software and Affected Versions Perses versions 0.43.0 through 0.54.0-rc.0 Description Datasource creation and unsaved datasource proxy paths authorize callers on a Datasource or GlobalDatasource scope but fail to require read permissions for the associated project or global...

PT-2026-67258

Name of the Vulnerable Software and Affected Versions Perses versions prior to 0.54.0-beta.3 Description An authenticated user with viewer access to one project can bypass authorization by supplying a different project via the project query parameter on project-scoped list endpoints, such as...

PT-2026-67257

Name of the Vulnerable Software and Affected Versions Perses versions prior to 0.54.0-rc.0 Description When using the file-system database, list endpoints bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

OPENSUSE-SU-2026:11413-1 perses-cli-0.54.0-1.1 on GA media

These are all security issues fixed in the perses-cli-0.54.0-1.1 package on the GA media of openSUSE Tumbleweed...