CVE-2026-77425: Unleash Feature Management Privilege Escalation

CVE-2026-77425 Overview

CVE-2026-77425 is an authorization flaw in Unleash, an open-source feature management platform. Versions prior to 8.0.3 fail to bind attacker-controlled strategy IDs to the project, feature, and environment specified in the request URL. The affected endpoint is POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order. An authenticated user with UPDATE_FEATURE_STRATEGY in one project can reorder strategies in another project, altering feature evaluation precedence. The issue maps to [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Authenticated users can reorder strategies across project, feature, or environment boundaries, silently changing feature-flag evaluation precedence in production.

Affected Products

Unleash Pro (multi-project deployments) prior to 8.0.3
Unleash Enterprise (multi-project deployments) prior to 8.0.3
Unleash OSS (single-project edition) prior to 8.0.3

Discovery Timeline

2026-09-22 - CVE-2026-77425 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-77425

Vulnerability Analysis

The vulnerable endpoint accepts a list of strategy IDs and new sort-order values. The handler passes those IDs directly to unprotectedUpdateStrategiesSortOrder and updateSortOrder without confirming that each ID belongs to the projectId, featureName, and environment from the URL. Authorization is enforced only against the URL context, not against the objects being mutated.

In multi-project Pro or Enterprise deployments, a user with UPDATE_FEATURE_STRATEGY in Project A who learns strategy IDs from Project B can reorder Project B's strategies. The audit event is attributed to Project A's URL context, obscuring the affected project during incident review. In OSS single-project deployments, the same missing binding still permits unauthorized reordering across features or environments within the default project.

The endpoint mutates only the sort_order column and does not modify strategy parameters, constraints, or segments. Impact is therefore limited to evaluation precedence, which can still flip a rollout, gate, or kill-switch to the wrong strategy.

Root Cause

The handler trusted client-supplied primary keys without verifying object ownership. This is a textbook Insecure Direct Object Reference pattern classified as [CWE-639].

Attack Vector

Exploitation requires network access to the Unleash admin API and an authenticated account with UPDATE_FEATURE_STRATEGY in at least one project. The attacker needs the target strategy UUIDs, which may be obtained through prior access, log exposure, or shared tooling.

typescript

// Security patch in src/lib/features/feature-toggle/feature-toggle-service.ts
// Commit 43e8db37b846921c8a94db58b44935ecbd15d9d1
            .map((strategy) => strategy.id);

        const eventPreData: StrategyIds = { strategyIds: existingOrder };
-
+        const allSortOrdersAreAlreadyKnown = sortOrders.every(({ id }) =>
+            existingOrder.includes(id),
+        );
+        if (!allSortOrdersAreAlreadyKnown) {
+            throw new BadDataError(
+                'trying to change strategies for environment via update sortOrder',
+            );
+        }
        await Promise.all(
            sortOrders.map(({ id, sortOrder }) =>
                this.featureStrategiesStore.updateSortOrder(id, sortOrder),

The fix enumerates strategies that legitimately belong to the URL's feature/environment (existingOrder) and rejects the request if any submitted ID falls outside that set. Source: GitHub Commit 43e8db3.

Detection Methods for CVE-2026-77425

Indicators of Compromise

Requests to /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order containing strategy IDs that do not belong to the URL's projectId, feature, or environment.
Audit-log strategy-order-changed events where the resulting strategy ordering does not match any strategy currently attached to the URL-referenced feature.
Unexpected changes to feature-flag evaluation outcomes without corresponding parameter, constraint, or segment updates.

Detection Strategies

Replay admin API logs and correlate each set-sort-order request body against the strategies actually bound to the URL feature/environment at request time. Flag mismatches.
Alert on any HTTP 4xx BadDataError responses from set-sort-order after upgrading, as these indicate probing attempts.
Compare rendered strategy order in the UI against expected order defined in infrastructure-as-code or GitOps sources.

Monitoring Recommendations

Forward Unleash admin API access logs and audit events to a centralized log store and retain them for post-incident review.
Track per-user request rates against set-sort-order endpoints; investigate accounts issuing bulk reorder calls across unrelated projects.
Baseline feature-flag evaluation outcomes so unexpected precedence changes trigger alerts.

How to Mitigate CVE-2026-77425

Immediate Actions Required

Upgrade all Unleash instances to version 8.0.3 or later.
Audit strategy-order-changed events since the affected version was deployed and confirm each ordering matches an approved change.
Review role assignments and revoke UPDATE_FEATURE_STRATEGY from accounts that do not require it.

Patch Information

The fix ships in Unleash 8.0.3. See GitHub Release v8.0.3 and GitHub Security Advisory GHSA-5ffh-6f9q-5hhr. The patch in commit 43e8db3 validates that every submitted strategy ID belongs to the URL-referenced feature and environment before writing sort-order updates.

Workarounds

If immediate patching is not possible, restrict UPDATE_FEATURE_STRATEGY to a minimal set of trusted operators.
Place the Unleash admin API behind a reverse proxy or WAF that enforces per-project path allow-lists on set-sort-order calls.
Increase audit-log review cadence for feature-strategy ordering changes until the patch is applied.

bash

# Upgrade Unleash to the patched release
npm install unleash-server@8.0.3

# Docker deployments
docker pull unleashorg/unleash-server:8.0.3
docker stop unleash && docker rm unleash
docker run -d --name unleash -p 4242:4242 \
  -e DATABASE_URL=$DATABASE_URL \
  unleashorg/unleash-server:8.0.3