Skip to content
OpenAdvisories

Package · npm

unleash-server

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.1
    CVE-2026-77426

    Unleash: Missing await on permission check + cross-project IDOR in admin API

    Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authentic…

    Unleash unleash unleash-server npm
  • High 7.5
    CVE-2026-63462

    Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

    Unleash is an open-source feature management platform. Prior to 7.5.2, 7.6.5, and 8.0.2, the shared OpenAPI validation error path in src/lib/error/bad-data-error.ts passes a raw request value from lodash.get to JSON.stringify in genericErrorMessage and fromOp…

    Unleash unleash unleash-server npm