CVE-2026-77426: 
JavaScript vulnerability analysis and mitigation

CVE-2026-77426 is a set of five authorization vulnerabilities in the Unleash open-source feature management platform's admin API, collectively described as "Missing await on permission check + cross-project IDOR in admin API." The vulnerabilities affect all versions of unleash-server (npm) prior to 8.0.3 and were disclosed on September 22, 2026. The most critical flaw is a missing await on an async permission check that completely bypasses authorization for segment strategy modifications; the remaining four are Insecure Direct Object Reference (IDOR) issues enabling cross-project data disclosure and modification. The CVSS v4.0 base score is 7.1 (High) (GitHub Advisory).

The vulnerabilities are classified under CWE-862 (Missing Authorization) and CWE-639 (Authorization Bypass Through User-Controlled Key). The primary flaw (Vuln 1) resides in src/lib/features/segment/segment-controller.ts (line 345): the POST /api/admin/segments/strategies handler calls this.accessService.hasPermission() without await, so the variable receives a truthy Promise object rather than the resolved boolean — causing the if (!hasFeatureStrategyPermission) guard to never trigger. The four IDOR flaws involve API endpoints that accept project-scoped URL parameters but perform lookups using only the resource identifier (feature name, strategy ID, or tag), without validating that the resource belongs to the specified project: GET /api/admin/projects/:projectId/features/:featureName/environments/:environment/variants (variants.ts line 213), GET .../strategies/:strategyId (feature-toggle-controller.ts line 1107), getEnvironmentInfo() (feature-toggle-service.ts line 1611), and PUT /:projectId/tags (feature-toggle-controller.ts line 576) (GitHub Advisory, Commit c93a963).

Any authenticated Unleash user — regardless of their project-level permissions — can exploit the missing await bug to modify segment assignments on any feature strategy across all projects and environments, constituting a high-integrity impact. The four IDOR vulnerabilities allow the same authenticated user to read variant configurations (names, weights, payloads), full strategy configurations, and environment metadata from projects they have no access to, as well as modify tags on features belonging to other projects. Collectively, these flaws break Unleash's project-based access control model, enabling unauthorized cross-project reconnaissance and configuration tampering that could affect feature flag rollout behavior in production environments (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only a valid authenticated session (low-privilege user), no special attack complexity, and is network-accessible, making it straightforward for any insider or compromised account to abuse (GitHub Advisory).

1. Authenticate: Obtain any valid Unleash user account (even a low-privilege account with access to a single project).
2. Exploit missing await (Vuln 1 — Segment Assignment Bypass): Send a POST request to /api/admin/segments/strategies with a body specifying projectId, environmentId, strategyId, and segmentIds targeting a strategy in a project the attacker does not have UPDATE_FEATURE_STRATEGY permission for. Because the permission check is never awaited, the 403 guard never fires and the modification succeeds.
3. Exploit cross-project variant read (Vuln 2): Send a GET request to /api/admin/projects/<attacker-controlled-projectId>/features/<target-featureName>/environments/<env>/variants using a featureName from a different project. The endpoint ignores projectId and returns variant configuration (names, weights, payloads) for the target feature.
4. Exploit cross-project strategy read (Vuln 3): Send a GET request to the strategy endpoint with a known or guessed strategyId from another project. The endpoint only validates strategyId, returning the full strategy configuration regardless of project context.
5. Exploit cross-project environment info leak (Vuln 4): Call getEnvironmentInfo via the relevant admin API endpoint supplying a featureName from a different project; the missing validateFeatureBelongsToProject call returns environment metadata for the target feature.
6. Exploit cross-project tag modification (Vuln 5): Send a PUT request to /:projectId/tags with a body containing feature identifiers belonging to a different project; the endpoint does not validate project membership and applies the tag modification. (GitHub Advisory, Commit c93a963, Commit bea7eff)

• Network/Logs: HTTP POST requests to /api/admin/segments/strategies from users who do not hold UPDATE_FEATURE_STRATEGY for the referenced projectId/environmentId that return HTTP 200 instead of 403.
• Network/Logs: GET requests to /api/admin/projects/<projectId>/features/<featureName>/environments/<env>/variants where projectId does not match the project owning featureName, returning HTTP 200.
• Network/Logs: GET requests to strategy endpoints (.../strategies/:strategyId) where the strategyId does not belong to the projectId or featureName in the URL path, returning HTTP 200.
• Network/Logs: PUT requests to /:projectId/tags containing feature names from projects other than projectId, returning HTTP 200.
• Application Logs: Unexpected segment assignment changes or tag modifications on features in projects where the acting user has no configured permissions, visible in Unleash audit logs. (GitHub Advisory)

Upgrade unleash-server (npm) to version 8.0.3 or later, which includes five targeted fixes: adding await to the hasPermission() call in segment-controller.ts; adding validateFeatureBelongsToProject() calls in the variants route and getEnvironmentInfo(); and adding strategyBelongsToFeatureAndProject() validation in the strategy read/patch handlers. No official configuration-based workaround is available for the missing await issue — patching is the only reliable remediation. Organizations unable to upgrade immediately should restrict Unleash admin API access to trusted internal networks and audit user permissions to minimize the blast radius (GitHub Advisory, Unleash v8.0.3 Release).