{"action":"Upgrade unleash-server to 8.0.3 or later.","affected":[{"fixed":"8.0.3","introduced":"0"}],"component":"unleash-server","cve_ids":["CVE-2026-77425"],"ecosystem":"npm","epss":0.00325,"exploited":false,"fixed_versions":["8.0.3"],"ghsa_id":"GHSA-5ffh-6f9q-5hhr","id":"tcs_01M5KF3G7W0AWKNSMAR5RZA027","modified_at":"2026-09-22T21:00:05.641811593Z","published_at":"2026-09-22T20:36:39Z","references":["https://osv.dev/vulnerability/GHSA-5ffh-6f9q-5hhr","https://github.com/Unleash/unleash/security/advisories/GHSA-5ffh-6f9q-5hhr","https://github.com/Unleash/unleash/commit/43e8db37b846921c8a94db58b44935ecbd15d9d1","https://github.com/Unleash/unleash","https://github.com/Unleash/unleash/releases/tag/v8.0.3"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-5ffh-6f9q-5hhr","url":"https://osv.dev/vulnerability/GHSA-5ffh-6f9q-5hhr"}],"summary":"Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log"}