Is CVE-2026-76910 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76910 being exploited in the wild.

How severe is CVE-2026-76910?

Medium severity, with a CVSS score of 4, published 22 September 2026.

Is there a fix for CVE-2026-76910?

Yes. unleash-server (npm): upgrade to 8.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76910 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76910?

Check whether you run unleash-server (npm) or Unleash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76910: Unleash feature-toggle authorization bypass in clone endpoint

CVE-2026-76910 · Severity: medium · CVSS 4 · Published 2026-09-22

Unleash is a feature flag management platform that controls feature rollout across applications. An attacker with create permissions in one project can clone feature flags from other projects they don't have access to, exposing sensitive configuration details like strategies, constraints, and variant payloads. This allows unauthorized disclosure of feature flag settings that may contain business logic or sensitive parameters.

Technologies: unleash-server (npm), Unleash. Vendors: npm, Unleash.

Quick answers

Is CVE-2026-76910 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76910 being exploited in the wild.
How severe is CVE-2026-76910?: Medium severity, with a CVSS score of 4, published 22 September 2026.
Which products and versions are affected?: unleash-server (npm) < 8.0.3, SEMVER:introduced=0,fixed=8.0.3; Unleash <UNKNOWN>.
Is there a fix for CVE-2026-76910?: Yes. unleash-server (npm): upgrade to 8.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76910 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76910?: Check whether you run unleash-server (npm) or Unleash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

unleash-server (npm): upgrade to 8.0.3 or later
```
npm install unleash-server@8.0.3
```

Technical details

The vulnerability is an authorization bypass in the clone-feature endpoint (src/lib/features/feature-toggle/feature-toggle-service.ts). The cloneFeatureToggle function validates that the caller has create permissions on the destination project, but fails to verify read access to the source project. Since feature names are globally unique, an authenticated attacker can reference any feature by name regardless of project isolation. The attack requires network access to the API and valid credentials with create permissions in at least one project; the attacker then crafts a POST request to /api/admin/projects/{project}/features/{sourceFeatureName}/clone to copy restricted features into their accessible project and inspect the complete configuration.

Affected products

Unleash Unleash <UNKNOWN>

Identifiers

CVE-2026-76910
GHSA-8xcj-9hfr-fh9j

Timeline

2026-09-22: disclosed
other: CVE-2026-76910 assigned

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.