CVE-2026-77426: Unleash Feature Platform Auth Bypass Vulnerability

CVE-2026-77426 Overview

Unleash is an open-source feature management platform used by development teams to control feature rollouts. Versions prior to 8.0.3 contain five authorization vulnerabilities in the admin API. The flaws allow authenticated users to bypass project and permission scoping, enabling cross-project disclosure of feature variants, strategies, and environment metadata. One flaw also permits unauthorized modification of segment assignments due to an unawaited hasPermission Promise. The issues map to [CWE-639: Authorization Bypass Through User-Controlled Key]. All five defects are resolved in Unleash 8.0.3.

Critical Impact
Authenticated users with limited project access can read and modify feature configuration data belonging to unrelated projects, breaking multi-tenant isolation of the admin API.

Affected Products

Unleash open-source feature management platform
All Unleash versions prior to 8.0.3
Deployments exposing the admin API to multi-tenant or multi-project users

Discovery Timeline

2026-09-22 - CVE-2026-77426 published to NVD
2026-09-23 - Last updated in NVD database
Unleash 8.0.3 - Vendor released patched version addressing all five authorization defects

Technical Details for CVE-2026-77426

Vulnerability Analysis

The advisory documents five distinct authorization defects in the Unleash admin API. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, so the permission check never resolves before the mutation executes. This lets any authenticated user modify segment assignments without holding UPDATE_FEATURE_STRATEGY for the target project and environment.

The remaining four defects are cross-project scoping failures. GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants does not bind the requested feature to projectId, disclosing variants from features in other projects. GET .../strategies/:strategyId looks up strategies by identifier alone, without validating project and feature context. getEnvironmentInfo does not verify that the requested feature belongs to the supplied project. PUT /:projectId/tags accepts feature identifiers without checking project ownership, allowing tag modification across project boundaries.

Root Cause

Each defect stems from trusting a caller-supplied identifier without cross-checking it against the URL project scope. The permission check regression is a related asynchronous programming error where a Promise was used in a boolean context instead of being awaited.

Attack Vector

An authenticated user with a valid session and low-privilege access to at least one project sends admin API requests referencing identifiers that belong to other projects. The server processes the request against the referenced resource without validating project ownership, returning configuration data or applying modifications the user is not authorized to perform.

typescript

// Patch: enforce project ownership in getEnvironmentInfo
    environment: string,
    featureName: string,
): Promise<IFeatureEnvironmentInfo> {
+   await this.validateFeatureBelongsToProject({
+       featureName,
+       projectId: project,
+   });
    const envMetadata =
        await this.featureEnvironmentStore.getEnvironmentMetaData(
            environment,
// Source: https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a

typescript

// Patch: bind variants lookup to projectId
    req: Request<FeatureEnvironmentParams, any, any, any>,
    res: Response<FeatureVariantsSchema>,
): Promise<void> {
-   const { featureName, environment } = req.params;
+   const { projectId, featureName, environment } = req.params;
+   await this.featureService.validateFeatureBelongsToProject({
+       featureName,
+       projectId,
+   });
    const variants = await this.featureService.getVariantsForEnv(
        featureName,
        environment,
// Source: https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1

Detection Methods for CVE-2026-77426

Indicators of Compromise

Admin API requests where the projectId path parameter and the resolved feature's actual project do not match in application logs.
Successful POST /api/admin/segments/strategies calls made by users lacking UPDATE_FEATURE_STRATEGY on the affected project.
Unexpected tag, variant, or strategy configuration changes appearing in project audit history without a corresponding authorized change ticket.

Detection Strategies

Enable and review Unleash audit events for feature strategy, variant, and tag modifications, correlating actor project membership against the modified resource's project.
Instrument reverse proxy logs to capture full admin API URLs and response codes, then flag 2xx responses on /api/admin/projects/:projectId/... where the requester has no role in :projectId.
Compare pre- and post-request feature configuration state via the Unleash export API to identify silent cross-project modifications.

Monitoring Recommendations

Forward Unleash application and audit logs to a centralized SIEM and build alerts on segment, strategy, and tag mutation events grouped by unusual actor-to-project pairs.
Track the running Unleash version across environments to confirm all instances are at 8.0.3 or later.
Baseline expected admin API call patterns per service account and alert on deviations that reference multiple projects from a single low-privilege identity.

How to Mitigate CVE-2026-77426

Immediate Actions Required

Upgrade all Unleash instances to version 8.0.3 or later, which contains fixes for all five authorization defects.
Audit recent admin API activity for cross-project reads or modifications performed by low-privilege users since the vulnerable versions were deployed.
Rotate any secrets, tokens, or feature flag values that may have been disclosed through the cross-project variant or strategy endpoints.

Patch Information

The fix is available in Unleash Release v8.0.3. Individual patches are tracked in commits 7bb2829f, ace121c9, bea7effd, c93a963e, and dd61d0e1. Full details are published in the GHSA-72h8-wp98-7hch advisory.

Workarounds

Restrict admin API network exposure to trusted operators and CI systems while upgrade windows are scheduled.
Reduce the number of authenticated users with any project role until the upgrade is applied, since exploitation requires a valid authenticated session.
Place an authorizing reverse proxy in front of Unleash that enforces per-user project scoping on admin API paths as a defense-in-depth control.

bash

# Verify Unleash server version after upgrade
curl -s https://unleash.example.com/health | jq '.'
curl -s -H "Authorization: $ADMIN_TOKEN" \
  https://unleash.example.com/api/admin/instance-admin | jq '.versionInfo'
# Confirm the reported version is 8.0.3 or later