CVE-2026-77426

npm/unleash-server CVE-2026-77426: high, EPSS 0.48%

Unleash: Missing await on permission check + cross-project IDOR in admin API

Action: Upgrade unleash-server to 8.0.3 or later.

npm i unleash-server@8.0.3

Affected

Fixed versions

Sources

• osv: GHSA-72h8-wp98-7hch
• https://github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch
• https://github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a
• https://github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1
• https://github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d
• https://github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a
• https://github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef
• https://github.com/Unleash/unleash
• https://github.com/Unleash/unleash/releases/tag/v8.0.3

CVE-2026-77426 · published 2026-09-22T20:36:42Z · modified 2026-09-22T21:00:05.644113072Z · JSON