CVE-2026-77425: Unleash authorization bypass in strategy reordering

CVE-2026-77425 · Severity: medium · CVSS 4.3 · Published 2026-09-22

Unleash is an open-source feature flag management platform used by teams to control feature rollouts in production. A cross-project authorization flaw allows any authenticated project member to silently reorder activation strategies of feature flags in other projects and environments they have no access to. Since strategy order determines which flag behavior is applied, an attacker can flip production flag outcomes for other teams (e.g., turning off a controlled rollout or changing variant behavior), while hiding the tampering from audit logs.

Technologies: unleash-server (npm), Unleash. Vendors: npm, Unleash.

Quick answers

Is CVE-2026-77425 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-77425 being exploited in the wild.
How severe is CVE-2026-77425?
Medium severity, with a CVSS score of 4.3, published 22 September 2026.
Which products and versions are affected?
unleash-server (npm) < 8.0.3, SEMVER:introduced=0,fixed=8.0.3; Unleash <= 8.0.0.
Is there a fix for CVE-2026-77425?
Yes. unleash-server (npm): upgrade to 8.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77425 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-77425?
Check whether you run unleash-server (npm) or Unleash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • unleash-server (npm): upgrade to 8.0.3 or later
    npm install unleash-server@8.0.3

Technical details

The vulnerability is an authorization bypass (CWE-639) in the POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order endpoint. The RBAC middleware authorizes against the URL projectId, but the handler fails to validate that the strategy IDs supplied in the request body belong to the target project/feature/environment. Instead, it writes directly to the database by primary key. An authenticated attacker with UPDATE_FEATURE_STRATEGY permission on any project can craft a request using their own project in the URL (to pass RBAC checks) and victim project's strategy IDs in the body to reorder strategies they should not access. The impact is limited to the sort_order column, not strategy parameters or constraints. Sibling endpoints (updateStrategy, patchStrategy, deleteStrategy) correctly call validateUpdatedProperties() to bind strategies to their context; the set-sort-order handler omits this check. The mutation is logged under the attacker's project context, bypassing the victim's audit trail. Patched in version 8.0.3.

Affected products

  • Unleash Unleash <= 8.0.0

Identifiers

  • CVE-2026-77425
  • GHSA-5ffh-6f9q-5hhr

Timeline

  • 2026-09-22: disclosed: GHSA-5ffh-6f9q-5hhr published
  • 2026-07-10: patched: Fixed in version 8.0.3 (commit 43e8db37b846921c8a94db58b44935ecbd15d9d1)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.