Vulnerabilities in pkg:npm/unleash-server

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-72h8-wp98-7hch",
  "modified" : "2026-09-22T20:36:42Z",
  "published" : "2026-09-22T20:36:42Z",
  "aliases" : [ "CVE-2026-77426" ],
  "summary" : "Unleash: Missing await on permission check + cross-project IDOR in admin API",
  "details" : "## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src/lib/features/segment/segment-controller.ts` (line 345)\n\n`POST /api/admin/segments/strategies` has `permission: NONE` at the route level. The handler performs its own check via `this.accessService.hasPermission()`, but **omits the `await` keyword**. Since `hasPermission()` is async (returns `Promise<boolean>`), the variable always receives a truthy Promise object. The `if (!hasFeatureStrategyPermission)` check never triggers.\n\n```typescript\n// BUG: missing await - hasPermission() returns Promise<boolean>\nconst hasFeatureStrategyPermission = this.accessService.hasPermission(\n    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,\n);\nif (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!\n    res.status(403).send();\n    return;\n}\n```\n\n**Impact:** Any authenticated user can modify segment assignments on ANY strategy across ALL projects.\n\n**Fix:** Add `await`: `const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)`\n\n## Vulnerability 2: Cross-Project Variant Read (MEDIUM)\n\n**File:** `src/lib/routes/admin-api/project/variants.ts` (line 213-223)\n\n`GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants` completely ignores `projectId`. `getVariantsOnEnv()` only uses `featureName` and `environment`.\n\n**Impact:** Any authenticated user can read variant configs (names, weights, payloads) from any project.\n\n## Vulnerability 3: Cross-Project Strategy Read (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 1107-1116)\n\n`GET .../strategies/:strategyId` ignores all params except `strategyId`. Any authenticated user can read any strategy's full configuration.\n\n## Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-service.ts` (line 1611)\n\n`getEnvironmentInfo()` doesn't validate feature belongs to project. Compare with `getFeature()` which calls `validateFeatureBelongsToProject()`.\n\n## Vulnerability 5: Cross-Project Tag Modification (LOW)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 576-596)\n\n`PUT /:projectId/tags` accepts features array in body without validating they belong to projectId.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "unleash-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "8.0.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/Unleash/unleash"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/Unleash/unleash/releases/tag/v8.0.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639", "CWE-862" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:36:42Z",
    "nvd_published_at" : null
  }
}