Unleash
Monthly
Authenticated users of Unleash (the open-source feature management platform) can bypass project-scoped authorization and reach configuration data and write operations belonging to projects and environments they should not control, due to a cluster of broken-access-control defects fixed in version 8.0.3. The most serious is a missing `await` on an async permission check in POST /api/admin/segments/strategies, which lets any authenticated account with an admin-API session modify segment assignments on any strategy in any project; four additional cross-project IDOR issues (CWE-639) expose variant configurations, strategy configurations, environment information, and permit tag modification across project boundaries. Exploitation requires only a valid Unleash account at any privilege level with network reach to the admin API - no anonymous access and no administrator role - so practical exposure is concentrated in multi-project or multi-tenant deployments where authenticated users are not uniformly trusted with every project; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Authenticated users who hold the UPDATE_FEATURE_STRATEGY permission in any single project can reorder the activation strategies of features in other projects, features, or environments in Unleash prior to 8.0.3, because the set-sort-order endpoint authorizes only against the project ID in the URL and then writes strategy IDs taken from the request body by primary key without verifying they belong to that context. In multi-project Pro or Enterprise deployments this is a cross-project integrity write that can flip which activation strategy takes precedence for another team's flag in production and is recorded under the attacker's own project context, while the single-project OSS edition is still affected but limited to unauthorized reordering across features or environments within the default project. The assessed severity is low (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - it requires a valid project role and knowledge of victim strategy IDs, and the impact ceiling is only sort_order changes, since strategy parameters, constraints, and segments cannot be altered; no public exploit identified at time of analysis.
Authenticated users of Unleash (npm unleash-server) prior to 8.0.3 who hold create or clone rights in any single project can abuse the clone-feature endpoint to copy a feature toggle out of a different project they cannot read, then inspect the copied strategy parameters, constraints, variants, and variant payloads. The flaw is a broken object-level authorization (CWE-639) in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone: the destination project is authorized but the source project is never checked, and because feature names are globally unique an attacker only needs the target feature's name (which may leak through SDKs shared across projects). Impact is limited to information disclosure (CVSS 4.0 5.3, PR:L, no integrity or availability effect); the vendor fixed it in 8.0.3 and no public exploit or CISA KEV entry was identified at time of analysis.
Unleash deployments prior to 8.0.3 render the change-request approval email template with Mustache triple-stash syntax, so the attacker-controlled changeRequestTitle, requesterName, and requesterEmail values are inserted into notification emails as raw, unescaped HTML. An authenticated project member who can create change requests (CVSS 4.0 vector AV:N/AC:L/PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R) can therefore place forged links, tracking content, or visually altered text into an approver's inbox, although the approver must open the email and mail clients block script execution, so the realistic outcome is HTML content spoofing rather than code execution. No evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents manual reproduction steps; severity is genuinely low (CVSS 2.1) and the vendor-released patch is Unleash 8.0.3.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.
Authenticated users of Unleash (the open-source feature management platform) can bypass project-scoped authorization and reach configuration data and write operations belonging to projects and environments they should not control, due to a cluster of broken-access-control defects fixed in version 8.0.3. The most serious is a missing `await` on an async permission check in POST /api/admin/segments/strategies, which lets any authenticated account with an admin-API session modify segment assignments on any strategy in any project; four additional cross-project IDOR issues (CWE-639) expose variant configurations, strategy configurations, environment information, and permit tag modification across project boundaries. Exploitation requires only a valid Unleash account at any privilege level with network reach to the admin API - no anonymous access and no administrator role - so practical exposure is concentrated in multi-project or multi-tenant deployments where authenticated users are not uniformly trusted with every project; no public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited.
Stack exhaustion denial-of-service in Unleash's OpenAPI validation middleware allows unauthenticated network attackers to terminate the Node.js server process by submitting a roughly 10 KB JSON payload nested thousands of levels deep to any OpenAPI-validated endpoint. Versions prior to 7.5.2, 7.6.5, and 8.0.2 are affected; the shared error-formatting path in src/lib/error/bad-data-error.ts calls JSON.stringify on raw request values without catching the resulting RangeError, which propagates uncaught and kills the process. No public exploit code has been identified at time of analysis, though the attack is trivially reproducible from the advisory description alone, and replaying the request sustains the outage indefinitely.
Authenticated users who hold the UPDATE_FEATURE_STRATEGY permission in any single project can reorder the activation strategies of features in other projects, features, or environments in Unleash prior to 8.0.3, because the set-sort-order endpoint authorizes only against the project ID in the URL and then writes strategy IDs taken from the request body by primary key without verifying they belong to that context. In multi-project Pro or Enterprise deployments this is a cross-project integrity write that can flip which activation strategy takes precedence for another team's flag in production and is recorded under the attacker's own project context, while the single-project OSS edition is still affected but limited to unauthorized reordering across features or environments within the default project. The assessed severity is low (CVSS 3.1 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) - it requires a valid project role and knowledge of victim strategy IDs, and the impact ceiling is only sort_order changes, since strategy parameters, constraints, and segments cannot be altered; no public exploit identified at time of analysis.
Authenticated users of Unleash (npm unleash-server) prior to 8.0.3 who hold create or clone rights in any single project can abuse the clone-feature endpoint to copy a feature toggle out of a different project they cannot read, then inspect the copied strategy parameters, constraints, variants, and variant payloads. The flaw is a broken object-level authorization (CWE-639) in cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone: the destination project is authorized but the source project is never checked, and because feature names are globally unique an attacker only needs the target feature's name (which may leak through SDKs shared across projects). Impact is limited to information disclosure (CVSS 4.0 5.3, PR:L, no integrity or availability effect); the vendor fixed it in 8.0.3 and no public exploit or CISA KEV entry was identified at time of analysis.
Unleash deployments prior to 8.0.3 render the change-request approval email template with Mustache triple-stash syntax, so the attacker-controlled changeRequestTitle, requesterName, and requesterEmail values are inserted into notification emails as raw, unescaped HTML. An authenticated project member who can create change requests (CVSS 4.0 vector AV:N/AC:L/PR:L; assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R) can therefore place forged links, tracking content, or visually altered text into an approver's inbox, although the approver must open the email and mail clients block script execution, so the realistic outcome is HTML content spoofing rather than code execution. No evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, though the vendor advisory documents manual reproduction steps; severity is genuinely low (CVSS 2.1) and the vendor-released patch is Unleash 8.0.3.
Process-wide Mustache HTML escaping is permanently disabled in Unleash (all versions prior to 8.0.3) from the first moment any notification addon formats a feature event, allowing an editor-level user who has placed Slack or Teams link syntax in their unrestricted username to inject attacker-controlled hyperlinks into every configured outbound notification channel - including Slack, Microsoft Teams, Datadog, New Relic, and email. The scope change (S:C in CVSS) reflects that the vulnerable assignment in FeatureEventFormatterMd contaminates Mustache rendering across email-service.ts, webhook.ts, datadog.ts, and new-relic.ts for the lifetime of the Node.js process. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Server-Side Request Forgery in Unleash's addon and integration subsystem (versions prior to 7.5.2, 7.6.5, and 8.0.2) allows authenticated operators with CREATE_ADDON or UPDATE_ADDON permissions to cause the Unleash server to issue HTTP requests to arbitrary internal network addresses, including loopback, link-local, and cloud metadata endpoints such as the AWS Instance Metadata Service. The vulnerability exists because operator-supplied URL parameters in Webhook, Slack, Microsoft Teams, Datadog, and New Relic integration configurations were passed directly to the internal fetch function without SSRF filtering, enabling blind network probing via event status responses and credential forwarding when Authorization or API key headers are configured. Vendor-released patches are available and no public exploit code has been identified at time of analysis.