The vulnerability allows an attacker who can create or clone features in a destination project to copy a feature from a source project without any verification of read access to that source. Because feature names are globally unique, the attacker can guess or obtain a target feature name and clone it, thereby revealing its strategy parameters, constraints, variants, and payloads. This results in a confidentiality breach of configuration data that may hold sensitive business or technical information, and the weakness is identified as CWE-639.

The Unleash open‑source feature‑management platform is affected in all releases earlier than version 8.0.3. Any installation of Unleash that has not been updated to 8.0.3 or later is vulnerable, while versions 8.0.3 and newer provide the fix described in the official release notes.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. An attacker can exploit it by sending authenticated REST requests to the clone endpoint, provided they have create or clone permissions in the target project and knowledge of a feature name in the source project. Successful exploitation leads to unauthorized read access to the full configuration of the cloned feature, exposing potentially sensitive data. The absence of source‑project access checks creates a clear privilege escalation within the platform’s permission model.