# CVE-2026-76910: Unleash feature-toggle authorization bypass in clone endpoint

Source: https://junglewise.ai/threats/cve-2026-76910-unleash-feature-toggle-authorization-bypass-in-clone-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-76910 · Severity: medium · CVSS 4 · Published 2026-09-22

Unleash is a feature flag management platform that controls feature rollout across applications. An attacker with create permissions in one project can clone feature flags from other projects they don't have access to, exposing sensitive configuration details like strategies, constraints, and variant payloads. This allows unauthorized disclosure of feature flag settings that may contain business logic or sensitive parameters.

Technologies: [unleash-server (npm)](https://junglewise.ai/threats/technologies/unleash-server), [Unleash](https://junglewise.ai/threats/technologies/unleash). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Unleash](https://junglewise.ai/threats/vendors/unleash).

## Quick answers

**Is CVE-2026-76910 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-76910 being exploited in the wild.

**How severe is CVE-2026-76910?** Medium severity, with a CVSS score of 4, published 22 September 2026.

**Which products and versions are affected?** unleash-server (npm) < 8.0.3, SEMVER:introduced=0,fixed=8.0.3; Unleash <UNKNOWN>.

**Is there a fix for CVE-2026-76910?** Yes. unleash-server (npm): upgrade to 8.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-76910 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-76910?** Check whether you run unleash-server (npm) or Unleash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- unleash-server (npm): upgrade to 8.0.3 or later

  ```sh
  npm install unleash-server@8.0.3
  ```


## Technical details

The vulnerability is an authorization bypass in the clone-feature endpoint (src/lib/features/feature-toggle/feature-toggle-service.ts). The cloneFeatureToggle function validates that the caller has create permissions on the destination project, but fails to verify read access to the source project. Since feature names are globally unique, an authenticated attacker can reference any feature by name regardless of project isolation. The attack requires network access to the API and valid credentials with create permissions in at least one project; the attacker then crafts a POST request to /api/admin/projects/{project}/features/{sourceFeatureName}/clone to copy restricted features into their accessible project and inspect the complete configuration.

## Affected products

- Unleash Unleash <UNKNOWN>

## Identifiers

- CVE-2026-76910
- GHSA-8xcj-9hfr-fh9j

## Timeline

- 2026-09-22: disclosed
- other: CVE-2026-76910 assigned

## Related threats

- [Unleash admin API missing await on permission check and cross-project IDOR](https://junglewise.ai/threats/cve-2026-77426-unleash-admin-api-missing-await-on-permission-check-and-cross)
- [Unleash authorization bypass in strategy reordering](https://junglewise.ai/threats/cve-2026-77425-unleash-authorization-bypass-in-strategy-reordering)
- [Unleash change-request approval email HTML injection](https://junglewise.ai/threats/cve-2026-76909-unleash-change-request-approval-email-html-injection)
- [Unleash global Mustache.escape override disables HTML escaping in notifications](https://junglewise.ai/threats/cve-2026-63466-unleash-global-mustache-escape-override-disables-html-escaping-in)
- [Unleash server unauthenticated denial of service via deeply nested JSON](https://junglewise.ai/threats/cve-2026-63462-unleash-server-unauthenticated-denial-of-service-via-deeply)