CVE-2026-77425

Description

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifying that the IDs belong to the project, feature, and environment authorized by the URL. In a multi-project Pro or Enterprise deployment, an authenticated user with UPDATE_FEATURE_STRATEGY in one project who knows another project's strategy IDs can reorder those strategies, changing feature evaluation precedence while the operation is attributed to the attacker's URL context rather than the affected project. The single-project OSS edition lacks the cross-project dimension, although the missing context binding still permits unauthorized reordering across features or environments in the default project. The endpoint changes only sort_order and does not modify strategy parameters, constraints, or segments. This issue is fixed in version 8.0.3.

Overview

State: PUBLISHED
Assigner (CNA): GitHub_M
CVSS severity: MEDIUM
CVSS score: 4.3 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Effective score: 4.3 / 10 MEDIUM source: CNA overview
CWE(s): CWE-639, CWE-863
Reserved: 2026-08-20
Published: 2026-09-22 20:28 UTC
Last updated: 2026-09-22 20:28 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/77xxx/CVE-2026-77425.json

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 21:17:32 UTC
NVD last modified: 2026-09-22 21:17:32 UTC
NVD CVSS v3.1: 4.3 / 10 MEDIUM source: security-advisories@github.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 1.4 / 10

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84865
Assigner: GitHub_M
Published: Sep 22, 2026, 8:28:58 PM
Updated: Sep 22, 2026, 8:28:58 PM
EUVD base score (CVSS 3.1): 4.3 / 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EUVD-reported EPSS: 0.0000
Vendors: Unleash
Products: unleash (< 8.0.3)
Aliases: GHSA-5ffh-6f9q-5hhr

ENISA description: Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifying that the IDs belong to the project, feature, and environment authorized by the URL. In a multi-project Pro or Enterprise deployment, an authenticated user with UPDATE_FEATURE_STRATEGY in one project who knows another project's strategy IDs can reorder those strategies, changing feature evaluation precedence while the operation is attributed to the attacker's URL context rather than the affected project. The single-project OSS edition lacks the cross-project dimension, although the missing context binding still permits unauthorized reordering across features or environments in the default project. The endpoint changes only sort_order and does not modify strategy parameters, constraints, or segments. This issue is fixed in version 8.0.3.

EUVD references (3)

Affected products (1)

Vendor	Product	Versions	Platforms
Unleash	unleash	`< 8.0.3` (affected)	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr x_refsource_CONFIRM
https://github.com/Unleash/unleash/commit/43e8db37b846921c8a94db58b44935ecbd15d9d1 x_refsource_MISC
https://github.com/Unleash/unleash/releases/tag/v8.0.3 x_refsource_MISC

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://github.com/Unleash/unleash/commit/43e8db37b846921c8a94db58b44935ecbd15d9d1 security-advisories@github.com
https://github.com/Unleash/unleash/releases/tag/v8.0.3 security-advisories@github.com
https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr security-advisories@github.com

Remediations (10)

CVE-2026-77425: Unleash: A project member can reorder activation ...

web:advisories.gitlab.com

Detect and mitigate CVE-2026-77425 with GitLab Dependency Scanning Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities.

2026-09-23 15:43 UTC
CVE-2026-77425 - Vulnerability Details - OpenCVE

web:app.opencve.io

Vendor Product Default status Versions Unleash unleash affected Version Status Constraints < 8.0.3 affected — Show moreShow less

2026-09-23 15:43 UTC
CVE-2026-77425 | Unauthorized Strategy Reordering in Unleash

web:basefortify.eu

Vulnerability report for CVE-2026-77425 , including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.

2026-09-23 15:43 UTC
CVE-2026-77425: Medium - Unleash is an open-source feature management ...

web:breachspider.com

BreachSpider maps CVE-2026-77425 in affected products to your ICS/OT assets with remediation and virtual patches. CVSS 4.3 Medium.

2026-09-23 15:43 UTC
CVE-2026-77425 - Unleash: A project member can reorder activation ...

web:cvefeed.io

The following list is the news that have been mention CVE-2026-77425 vulnerability anywhere in the article. Results are limited to the first 20 news articles due to potential performance issues. EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

2026-09-23 15:43 UTC
CVE-2026-77425: Unleash Vulnerability (CVSS 4.3) | CVETodo

web:cvetodo.com

CVE-2026-77425 is a CVSS 4.3 medium-severity vulnerability in Unleash. Full technical analysis, mitigations , and exploit status — updated in real time.

2026-09-23 15:43 UTC
CVE-2026-77425 - Detail CVSS, EPSS & CISA Kev | CVE Find

web:www.cvefind.com

Full details for CVE-2026-77425 : technical description, impact, CVSS/EPSS scores, linked CWE, CAPEC, affected CPEs, disclosure date, and mitigation options.

2026-09-23 15:43 UTC
CVE-2026-77425: unleash: Unleash is an open-source feature ... - Rapid7

web:www.rapid7.com

CVE-2026-77425 : unleash: Unleash is an open-source feature management platform. View severity, references, and remediation details from Rapid7.

2026-09-23 15:43 UTC
CVE-2026-77425 | Redsauce

web:www.redsauce.net

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies ...

2026-09-23 15:43 UTC
CVE-2026-77425 | Tenable®

web:www.tenable.com

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies ...

2026-09-23 15:43 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-77425.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "unleash",
          "vendor": "Unleash",
          "versions": [
            {
              "status": "affected",
              "version": "< 8.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder and updateSortOrder without verifying that the IDs belong to the project, feature, and environment authorized by the URL. In a multi-project Pro or Enterprise deployment, an authenticated user with UPDATE_FEATURE_STRATEGY in one project who knows another project's strategy IDs can reorder those strategies, changing feature evaluation precedence while the operation is attributed to the attacker's URL context rather than the affected project. The single-project OSS edition lacks the cross-project dimension, although the missing context binding still permits unauthorized reordering across features or environments in the default project. The endpoint changes only sort_order and does not modify strategy parameters, constraints, or segments. This issue is fixed in version 8.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T20:28:58.895Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr"
        },
        {
          "name": "https://github.com/Unleash/unleash/commit/43e8db37b846921c8a94db58b44935ecbd15d9d1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Unleash/unleash/commit/43e8db37b846921c8a94db58b44935ecbd15d9d1"
        },
        {
          "name": "https://github.com/Unleash/unleash/releases/tag/v8.0.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Unleash/unleash/releases/tag/v8.0.3"
        }
      ],
      "source": {
        "advisory": "GHSA-5ffh-6f9q-5hhr",
        "discovery": "UNKNOWN"
      },
      "title": "Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77425",
    "datePublished": "2026-09-22T20:28:58.895Z",
    "dateReserved": "2026-08-20T19:59:59.603Z",
    "dateUpdated": "2026-09-22T20:28:58.895Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}