[ Vendor · 4 CVEs ]
Unleash
CVEs affecting Unleash published in the last 30 days, plus any Unleash CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-77426 | 22 Sep 2026 | CVSS 7.1 | Unleash: Missing await on permission check + cross-project IDOR in admin APIUnleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST… | Fix |
| CVE-2026-77425 | 22 Sep 2026 | CVSS 4.3 | Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit logUnleash is an open-source feature management platform. Prior to 8.0.3, POST… | Fix |
| CVE-2026-76910 | 22 Sep 2026 | CVSS 5.3 | Unleash: Clone-feature lets a user copy a feature from a project they cannot readUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST… | Fix |
| CVE-2026-76909 | 22 Sep 2026 | CVSS 2.1 | Unleash: CR-approval email renders user-controlled raw HTMLUnleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at… | Fix |