Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-76910 Details

Description

Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Unleash/unleash/security/advisories/GHSA-8xcj-9hfr-fh9j	CISA-ADP
https://github.com/Unleash/unleash/commit/2dc6ac0e8ba524ec7a2e9bc96a0e01d9d6f5a35a	[email protected]
https://github.com/Unleash/unleash/releases/tag/v8.0.3	[email protected]
https://github.com/Unleash/unleash/security/advisories/GHSA-8xcj-9hfr-fh9j	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-639	Authorization Bypass Through User-Controlled Key	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 23, 2026	CVE Modified	CISA-ADP
Sep 22, 2026	New CVE Received	[email protected]