CVE-2026-77426: Unleash: Missing await on permission check + cross-project IDOR in admin API
Multiple authorization vulnerabilities in Unleash admin API, including a critical missing await that completely bypasses a permission check.
References
- github.com/Unleash/unleash/commit/7bb2829fc40791aa478e8ffca149c11b0f9cb05a
- github.com/Unleash/unleash/commit/ace121c922d2e3eb6f68d95b0b6ab2fc8d824ea1
- github.com/Unleash/unleash/commit/bea7effd3687425630423f662136d548e100154d
- github.com/Unleash/unleash/commit/c93a963e95e1b7bf1bca2a7729282a48d0eb2f6a
- github.com/Unleash/unleash/commit/dd61d0e10f5977a2e5de78df467c3a17c09fbcef
- github.com/Unleash/unleash/releases/tag/v8.0.3
- github.com/Unleash/unleash/security/advisories/GHSA-72h8-wp98-7hch
- github.com/advisories/GHSA-72h8-wp98-7hch
- nvd.nist.gov/vuln/detail/CVE-2026-77426
Code Behaviors & Features
Detect and mitigate CVE-2026-77426 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →