Perses, an open‑source observability dashboard, allows a user with low‑privilege datasource‑creation rights to attach a secret that they are not normally permitted to read. The missing authorization on the datasource proxy path lets Perses resolve that secret and return the decrypted value in plaintext, effectively leaking secrets across project and global scopes. This flaw corresponds to CWE‑1220 (Missing Authorization) and CWE‑862 (Missing Permission Check).

The vulnerability affects Perses releases from 0.43.0 up to (but not including) 0.54.0‑rc.0. Any deployment of Perses within this version range is potentially vulnerable, regardless of the organization’s configuration or underlying secrets. The issue is fixed in version 0.54.0‑rc.0.

The CVSS score of 8.3 classifies the flaw as high severity. The EPSS score is less than 1 %, indicating that the likelihood of exploitation in the wild is low, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can create or modify a datasource—typically possessing GlobalDatasource:create or the project‑level equivalent—can exploit the flaw without needing elevated system privilege or additional credentials.