Executive brief
Unleash is a feature flag management platform that controls feature rollout across applications. An attacker with create permissions in one project can clone feature flags from other projects they don't have access to, exposing sensitive configuration details like strategies, constraints, and variant payloads. This allows unauthorized disclosure of feature flag settings that may contain business logic or sensitive parameters.
Technical details
The vulnerability is an authorization bypass in the clone-feature endpoint (src/lib/features/feature-toggle/feature-toggle-service.ts). The cloneFeatureToggle function validates that the caller has create permissions on the destination project, but fails to verify read access to the source project. Since feature names are globally unique, an authenticated attacker can reference any feature by name regardless of project isolation. The attack requires network access to the API and valid credentials with create permissions in at least one project; the attacker then crafts a POST request to /api/admin/projects/{project}/features/{sourceFeatureName}/clone to copy restricted features into their accessible project and inspect the complete configuration.
Affected products
- Unleash Unleash <UNKNOWN>
Timeline
- 2026-09-22: disclosed
- other: CVE-2026-76910 assigned