Executive brief
Unleash is a feature management platform that controls feature toggles and deployment settings across projects. Multiple authorization flaws in its admin API allow authenticated users to bypass permission checks and access data from arbitrary projects, including modifying segment assignments, reading variant configurations, and changing feature tags across organizational boundaries. This completely undermines the project isolation model that governs multi-tenant deployments.
Technical details
The vulnerabilities stem from five distinct authorization failures in the admin API. The most critical is a missing `await` on an async permission check in the segment-controller (POST /api/admin/segments/strategies): the code calls `hasPermission()` but neglects to await the returned Promise, causing the truthy Promise object to always pass the conditional guard, completely bypassing the UPDATE_FEATURE_STRATEGY permission validation. The remaining four are insecure direct object references (IDOR) where API endpoints fail to validate that requested resources belong to the specified project: variants endpoint ignores projectId entirely, strategies endpoint ignores all parameters except strategyId, environment-info endpoint lacks ownership validation, and tag-modification endpoint accepts feature arrays without verifying project membership. All require only authentication (no special privilege) to exploit. Patches adding await and proper ownership checks are available.
Affected products
- Unleash Unleash <5.9.0
Timeline
- 2026-09-22: disclosed
- other: CVE-2026-77426 assigned