NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API

NPM: Unleash: Missing await on permission check + cross-project IDOR in admin API vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

NPM: Unleash: A project member can reorder activation strategies belonging to any other project / environment cross-project integrity write, bypassing project RBAC and the audit log vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: CR-approval email renders user-controlled raw HTML

NPM: Unleash: CR-approval email renders user-controlled raw HTML vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-77426 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-77426 Source advisory: MEND:CVE-2026-77426...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-77425 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-77425 Source advisory: MEND:CVE-2026-77425...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-76910 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-76910 Source advisory: MEND:CVE-2026-76910...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-76909 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-76909 Source advisory: MEND:CVE-2026-76909...

GHSA-R5PQ-6CHH-J3XP Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

Summary An unauthenticated POST to any OpenAPI-validated endpoint, including the anonymous POST /edge/validate and POST /edge/issue-token, crashes the entire Unleash server with one request body of deeply-nested JSON. When request-body validation fails, Unleash builds the error message by calling...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-63466 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-63466 Source advisory: MEND:CVE-2026-63466...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-63462 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-63462 Source advisory: MEND:CVE-2026-63462...

sourceapp (>=0.0.1-alpha.29, <=0.0.5-beta.15) potentially affected by CVE-2026-63004 via unleash-server (>=4.20.0, <=4.20.4)

unleash-server NPM version =4.20.0, =0.0.1-alpha.29, =0.0.5-beta.15 Source cves: CVE-2026-63004 Source advisory: MEND:CVE-2026-63004...