In addition to the primary authorization bypass, the Unleash admin API contains multiple Insecure Direct Object Reference (IDOR) vulnerabilities. These flaws permit authenticated attackers to bypass project boundaries to read variant configurations, retrieve strategy details, leak environment information, and modify tags. These issues stem from a failure to validate project ownership or cross-reference parameters against authorized project scopes during API requests. Organizations running affected versions are exposed to unauthorized information disclosure and potential configuration tampering.

Impact

Successful exploitation allows any authenticated user to gain elevated privileges, enabling them to modify feature strategy configurations and perform cross-project read/write operations. This leads to unauthorized access to feature variant definitions, internal strategy details, and project tagging structures. These vulnerabilities undermine the security posture of feature management systems, potentially allowing an attacker to manipulate application behavior or exfiltrate sensitive configuration information across an entire organization's feature toggle environment.

Recommendation

• Upgrade Unleash server to version 8.0.3 or later immediately to resolve CVE-2026-77426 and associated IDOR vulnerabilities.
• Review audit logs for unauthorized administrative activity, particularly involving the /api/admin/segments/strategies endpoint, starting from the time of deployment of the vulnerable version.
• Implement restrictive network access controls to ensure that only authorized internal systems and personnel can access the Unleash admin API.