CVE-2026-76910 Unleash: Clone-feature lets a user copy a feature from a project they cannot read
Attackers can clone features from unauthorized projects to inspect sensitive configuration data if they have clone permissions in another project.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-76910?
CVE-2026-76910 is a medium-severity missing authorization vulnerability in unleash, published on 22 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because feature names are globally unique, a user with create or clone permission in one project who knows or guesses another project's feature name can copy that feature into the authorized project and inspect its strategy parameters, constraints, variants, and variant payloads. This issue is fixed in version 8.0.3.
Weakness: CWE-639
Which versions are affected by CVE-2026-76910?
2 open source packages ship an affected version, including unleash-server.
| Package | Affected | Fixed in |
|---|---|---|
unleash-server npm | All versions | 8.0.3 |
unleash-server npm | All versions | 8.0.3 |
How do I fix CVE-2026-76910?
Upgrade unleash-server to 8.0.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-76910 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76910 exists.
Sources
Also known as GHSA-8xcj-9hfr-fh9j, MINI-v9mx-5jv3-52fr.