CVE-2026-76910: 
JavaScript vulnerability analysis and mitigation

CVE-2026-76910 is an authorization bypass vulnerability in Unleash, an open-source feature management platform, that allows authenticated users to clone feature toggles from projects they do not have read access to. The flaw exists in the cloneFeatureToggle function and the POST /api/admin/projects/:projectId/features/:featureName/clone endpoint, which authorize only against the destination project without verifying access to the source project. All versions prior to 8.0.3 (specifically ≤7.6.4) are affected. It was disclosed on July 10, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is an incomplete authorization check classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerable code in src/lib/features/feature-toggle/feature-toggle-service.ts implements cloneFeatureToggle but only validates that the caller has create/clone permissions in the destination project — it never checks whether the caller has read access to the source project that owns the feature being cloned. Because feature names are globally unique across all projects in Unleash, an attacker who knows or guesses a feature name in a restricted project can reference it directly in the clone API call. The fix, applied in commit 2dc6ac0, adds a call to validateFeatureBelongsToProject with exposeExistingFeature: false before the clone operation, and also suppresses error messages that previously revealed which project a feature belonged to, closing a secondary information disclosure path (GitHub Advisory, Fix Commit).

Successful exploitation allows a low-privileged authenticated user to copy a feature toggle from any project — including restricted or private ones — into a project where they have create permissions, and then inspect the cloned feature's full configuration. Exposed data includes strategy parameters, constraints, variants, and variant payloads, which may contain sensitive business logic, targeting rules, or configuration secrets. There is no integrity or availability impact; the vulnerability is limited to confidentiality of feature toggle configuration data. The advisory notes that full confirmation requires Enterprise access, as feature names may be discoverable in environments where a shared SDK has access to multiple projects (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid authenticated account with clone or create permissions in at least one project, and knowledge or enumeration of feature names in other projects. The advisory notes that feature names may be observable through shared SDK access in multi-project environments, lowering the bar for reconnaissance (GitHub Advisory, Feedly).

1. Reconnaissance: Authenticate to the Unleash instance with a low-privileged account that has clone or create permissions in at least one project (e.g., Project P2). Identify or enumerate feature names from other projects (e.g., secret-feature in Project P1) by observing SDK event streams, shared API keys, or error messages from the API.
2. Craft the clone request: Construct an HTTP POST request targeting the clone endpoint in the attacker-controlled project, referencing the source feature name from the restricted project:

POST /api/admin/projects/P2/features/secret-feature/clone
Content-Type: application/json
Authorization: Bearer <attacker_token>

{"name": "secret-feature-copy"}

3. Submit the request: Send the request to the Unleash API. The server validates only that the attacker has clone permissions in P2, not that they can read secret-feature in P1, and proceeds to copy the feature.
4. Inspect the cloned feature: Navigate to Project P2 and open secret-feature-copy. Review the copied strategy parameters, constraints, variants, and variant payloads to extract sensitive configuration from the source project (GitHub Advisory).

• Network/API Logs: HTTP POST requests to /api/admin/projects/<projectId>/features/<featureName>/clone where <featureName> does not belong to <projectId>; repeated clone requests from a single user account targeting multiple feature names across different projects.
• Application Logs: Unleash audit log entries showing feature clone events where the source feature's project differs from the destination project; clone operations performed by users with no read access to the source project.
• Behavioral: A user account with limited project access suddenly having cloned features in their project that mirror configurations from restricted projects; unexpected new feature toggles appearing in a project with names resembling features from other projects.

Upgrade Unleash to version 8.0.3 or later, which includes the fix that validates source project membership before allowing a clone operation (Unleash Release, Fix Commit). No configuration-based workaround is available for versions prior to 8.0.3. As an interim measure, administrators should audit clone/create permissions and restrict them to trusted users only, and review audit logs for suspicious cross-project clone activity.

The vulnerability was reported by a researcher named Tymek and published as a GitHub Security Advisory (GHSA-8xcj-9hfr-fh9j) by Unleash maintainer chriswk on July 10, 2026. The advisory notes that the vulnerability cannot be fully confirmed without Enterprise access, as it is based on circumstantial evidence in the open-source repository. No significant broader media coverage or social media discussion has been identified (GitHub Advisory).