Executive brief
Unleash is an open-source feature flag management platform used by teams to control feature rollouts in production. A cross-project authorization flaw allows any authenticated project member to silently reorder activation strategies of feature flags in other projects and environments they have no access to. Since strategy order determines which flag behavior is applied, an attacker can flip production flag outcomes for other teams (e.g., turning off a controlled rollout or changing variant behavior), while hiding the tampering from audit logs.
Technical details
The vulnerability is an authorization bypass (CWE-639) in the POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order endpoint. The RBAC middleware authorizes against the URL projectId, but the handler fails to validate that the strategy IDs supplied in the request body belong to the target project/feature/environment. Instead, it writes directly to the database by primary key. An authenticated attacker with UPDATE_FEATURE_STRATEGY permission on any project can craft a request using their own project in the URL (to pass RBAC checks) and victim project's strategy IDs in the body to reorder strategies they should not access. The impact is limited to the sort_order column, not strategy parameters or constraints. Sibling endpoints (updateStrategy, patchStrategy, deleteStrategy) correctly call validateUpdatedProperties() to bind strategies to their context; the set-sort-order handler omits this check. The mutation is logged under the attacker's project context, bypassing the victim's audit trail. Patched in version 8.0.3.
Affected products
- Unleash Unleash <= 8.0.0
Timeline
- 2026-09-22: disclosed: GHSA-5ffh-6f9q-5hhr published
- 2026-07-10: patched: Fixed in version 8.0.3 (commit 43e8db37b846921c8a94db58b44935ecbd15d9d1)