unleash/unleash Security Advisories | GitStock

high2026-09-22

CVE-2026-77426-Unleash: Missing await on permission check + cross-project IDOR in admin API

GHSA-72h8-wp98-7hch

medium2026-09-22

CVE-2026-77425-Unleash: A project member can reorder activation strategies belonging to any other project / environment (cross-project integrity write), bypassing project RBAC and the audit log

GHSA-5ffh-6f9q-5hhr

medium2026-09-22

CVE-2026-76910-Unleash: Clone-feature lets a user copy a feature from a project they cannot read

GHSA-8xcj-9hfr-fh9j

low2026-09-22

CVE-2026-76909-Unleash: CR-approval email renders user-controlled raw HTML

GHSA-7hvx-28gp-mf6j

medium2026-08-21

CVE-2026-63466-Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

GHSA-w4mq-xh27-6xpx

medium2026-08-21

CVE-2026-63004-Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

GHSA-5vf6-jrqr-78fj

high2026-08-21

CVE-2026-63462-Unleash: Unauthenticated single-request DoS via OpenAPI validation error formatter

GHSA-r5pq-6chh-j3xp