CVE-2026-77425

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifyin...

PT-2026-97049

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3 Description An authorization bypass exists in the feature management platform where the system fails to verify if strategy IDs provided in a request body belong to the project, feature, and environment specified...