CVE-2026-77426

Name of the Vulnerable Software and Affected Versions Unleash versions prior to 8.0.3

Description The admin API contains five authorization issues. A missing await keyword in the POST /api/admin/segments/strategies endpoint allows authenticated users to modify segment assignments without the required UPDATE FEATURE STRATEGY permission. Additionally, several endpoints allow cross-project data access or modification: GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants allows disclosure of variant configurations, GET .../strategies/:strategyId allows disclosure of strategy configurations, the getEnvironmentInfo() function allows disclosure of environment information, and PUT /:projectId/tags allows the modification of tags across projects. These issues occur because the system fails to properly validate that the requested features or strategies belong to the specified project context.

Recommendations Update to version 8.0.3. As a temporary workaround, restrict access to the POST /api/admin/segments/strategies, GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants, GET .../strategies/:strategyId, and PUT /:projectId/tags endpoints to only highly trusted administrators.