Unleash: Clone-feature lets a user copy a feature from a project they cannot read
cve-program · CVE-2026-76910
PublishedUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Read the publisher's advisoryeuvd · EUVD-2026-84863
PublishedUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Read the publisher's advisorynvd · CVE-2026-76910
PublishedUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Read the publisher's advisoryosv · GHSA-8xcj-9hfr-fh9j
Published### Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with _create_ permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. This vulnerability cannot be confirmed without Enterprise access. Report is based on a circumstantial evidence in the open-source repository. ### Details `src/lib/features/feature-toggle/feature-toggle-service.ts` implements `cloneFeatureToggle`. This operation needs authorization for both sides: permission to read/copy the source feature and permission to create the destination feature. The clone path validates permissions against the destination project, but not against the source project that owns `featureName`. Because feature names are globally unique, a caller can reference a feature outside projects they can access. ### PoC 1. Create or identify two projects: `P1` with a private or restricted feature named `secret-feature`, and `P2` where the attacker has clone/create permissions. 2. Authenticate as the attacker. 3. Send: ```http POST /api/admin/projects/P2/features/secret-feature/clone Content-Type: application/json { "name": "secret-feature-copy" } ``` 4. Open `P2` and inspect `secret-feature-copy`. Verify if strategy parameters, constraints, variants, and variant payloads from the source feature have been copied. ### Impact Users with permissions on one project can disclose feature configuration from another project if they know or guess the source feature name. Feature names could be available in more public applications that have a common SDK access to multiple projects.
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2026-76910
PublishedUnleash: Clone-feature lets a user copy a feature from a project they cannot read
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
- Source published
- 22 Sep 2026 20:21:35 UTC
- Source modified
- 23 Sep 2026 19:40:00 UTC
- Saved here
- 23 Oct 2026 15:48:27 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
euvd · EUVD-2026-84863
PublishedUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the sour…
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Sep 22, 2026, 8:21:35 PM
dateUpdated: Sep 23, 2026, 7:40:00 PM
- Source published
- Sep 22, 2026, 8:21:35 PM (timezone not stated)
- Source modified
- Sep 23, 2026, 7:40:00 PM (timezone not stated)
- Saved here
- 11 Nov 2026 16:08:03 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 4.0 · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
nvd · CVE-2026-76910
PublishedUnleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the sour…
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Awaiting Analysis
Weakness classifications: CWE-639
Original publisher date fields
published: 2026-09-22T21:17:32.037
lastModified: 2026-09-23T20:17:15.303
- Source published
- 22 Sep 2026 21:17:32 UTC
- Source modified
- 23 Sep 2026 20:17:15 UTC
- Saved here
- 25 Oct 2026 16:19:04 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 4.0 · [email protected] · Secondary · 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv · GHSA-8xcj-9hfr-fh9j
PublishedUnleash: Clone-feature lets a user copy a feature from a project they cannot read
### Summary The clone-feature endpoint supports copying features across projects, but it does not verify that the caller can access the source project. A user with _create_ permissions in one project can clone a feature from another project they cannot read and then inspect the copied configuration. This vulnerability cannot be confirmed without Enterprise access. Report is based on a circumstantial evidence in the open-source repository. ### Details `src/lib/features/feature-toggle/feature-toggle-service.ts` implements `cloneFeatureToggle`. This operation needs authorization for both sides: permission to read/copy the source feature and permission to create the destination feature. The clone path validates permissions against the destination project, but not against the source project that owns `featureName`. Because feature names are globally unique, a caller can reference a feature outside projects they can access. ### PoC 1. Create or identify two projects: `P1` with a private or restricted feature named `secret-feature`, and `P2` where the attacker has clone/create permissions. 2. Authenticate as the attacker. 3. Send: ```http POST /api/admin/projects/P2/features/secret-feature/clone Content-Type: application/json { "name": "secret-feature-copy" } ``` 4. Open `P2` and inspect `secret-feature-copy`. Verify if strategy parameters, constraints, variants, and variant payloads from the source feature have been copied. ### Impact Users with permissions on one project can disclose feature configuration from another project if they know or guess the source feature name. Feature names could be available in more public applications that have a common SDK access to multiple projects.
- Source published
- 22 Sep 2026 20:34:40 UTC
- Source modified
- 22 Sep 2026 21:00:03 UTC
- Saved here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Publisher rating · MODERATE