Executive brief
Perses is a dashboard and data visualization platform that uses projects to isolate data and access control between teams. An authenticated user can bypass project-level access controls by manipulating a query parameter, allowing them to read dashboards, data sources, and variables from projects they should not have access to, even if they have no assigned role on those projects.
Technical details
This is an authorization bypass vulnerability (CWE-639) in Perses' API endpoints for project-scoped read resources. An authenticated user with a viewer role on one project can request endpoints such as GET /api/v1/projects/team-a/dashboards?project=finance-secret or GET /api/v1/datasources?project=finance-secret to retrieve full resource listings from other projects to which they have no access. The vulnerability affects all project-scoped read operations and completely defeats project-level tenant isolation. Attack requires only network access and an authenticated session (low privilege); no additional preconditions apply. The vulnerability was patched in version 0.54.0-beta.3.
Affected products
- Perses Perses < 0.54.0-beta.3
Timeline
- 2026-07-15: disclosed
- 2026-09-18: advisory
- 2026-09-18: patched: version 0.54.0-beta.3 released