Description
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| perses | perses | < 0.54.0-beta.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perses-cli | 0.54.0-1.1 | openSUSE-SU-2026:11413-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/perses/perses | < 0.54.0-beta.3 | 0.54.0-beta.3 | GHSA-cjgj-2fwf-4c2w |
Advisories 1
- openSUSE-SU-2026:11413-1 perses-cli-0.54.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 1, 2026