{"id":"GHSA-72h8-wp98-7hch","summary":"Unleash: Missing await on permission check + cross-project IDOR in admin API","details":"## Summary\n\nMultiple authorization vulnerabilities in Unleash admin API, including a critical missing `await` that completely bypasses a permission check.\n\n## Vulnerability 1: Missing `await` on Permission Check (HIGH)\n\n**File:** `src/lib/features/segment/segment-controller.ts` (line 345)\n\n`POST /api/admin/segments/strategies` has `permission: NONE` at the route level. The handler performs its own check via `this.accessService.hasPermission()`, but **omits the `await` keyword**. Since `hasPermission()` is async (returns `Promise\u003cboolean\u003e`), the variable always receives a truthy Promise object. The `if (!hasFeatureStrategyPermission)` check never triggers.\n\n```typescript\n// BUG: missing await - hasPermission() returns Promise\u003cboolean\u003e\nconst hasFeatureStrategyPermission = this.accessService.hasPermission(\n    req.user, UPDATE_FEATURE_STRATEGY, projectId, environmentId,\n);\nif (!hasFeatureStrategyPermission) { // Always false - Promise is truthy!\n    res.status(403).send();\n    return;\n}\n```\n\n**Impact:** Any authenticated user can modify segment assignments on ANY strategy across ALL projects.\n\n**Fix:** Add `await`: `const hasFeatureStrategyPermission = await this.accessService.hasPermission(...)`\n\n## Vulnerability 2: Cross-Project Variant Read (MEDIUM)\n\n**File:** `src/lib/routes/admin-api/project/variants.ts` (line 213-223)\n\n`GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants` completely ignores `projectId`. `getVariantsOnEnv()` only uses `featureName` and `environment`.\n\n**Impact:** Any authenticated user can read variant configs (names, weights, payloads) from any project.\n\n## Vulnerability 3: Cross-Project Strategy Read (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 1107-1116)\n\n`GET .../strategies/:strategyId` ignores all params except `strategyId`. Any authenticated user can read any strategy's full configuration.\n\n## Vulnerability 4: Cross-Project Environment Info Leak (MEDIUM)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-service.ts` (line 1611)\n\n`getEnvironmentInfo()` doesn't validate feature belongs to project. Compare with `getFeature()` which calls `validateFeatureBelongsToProject()`.\n\n## Vulnerability 5: Cross-Project Tag Modification (LOW)\n\n**File:** `src/lib/features/feature-toggle/feature-toggle-controller.ts` (line 576-596)\n\n`PUT /:projectId/tags` accepts features array in body without validating they belong to projectId.","aliases":["CVE-2026-77426"],"modified":"2026-09-22T21:00:05.644113072Z","published":"2026-09-22T20:36:42Z","database_specific":{"github_reviewed_at":"2026-09-22T20:36:42Z","nvd_published_at":null,"cwe_ids":["CWE-639","CWE-862"],"severity":"HIGH","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a"},{"type":"WEB","url":"https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef"},{"type":"PACKAGE","url":"https://github.com/Unleash/unleash"},{"type":"WEB","url":"https://github.com/Unleash/unleash/releases/tag/v8.0.3"}],"affected":[{"package":{"name":"unleash-server","ecosystem":"npm","purl":"pkg:npm/unleash-server"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.0.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-72h8-wp98-7hch/GHSA-72h8-wp98-7hch.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}