The vulnerability is an unprotected API endpoint that accepts attacker‑controlled strategy IDs and updates the sort order without ensuring that the IDs belong to the project, feature, and environment specified in the URL. This lack of context binding allows an authenticated user who holds UPDATE_FEATURE_STRATEGY permission in one project to reorder strategies in another project or across features within the same project. The effect is an integrity break that changes feature‑flag evaluation precedence while the action is recorded under the attacker’s project context rather than the affected project. The weakness is classified as CWE‑639 (Privilege‑or‑Permission‑Related Error) and CWE‑863 (Missing Context Binding).

All installations of the Unleash feature‑management platform with a version older than 8.0.3 are affected. The issue is applicable to multi‑project Pro or Enterprise deployments where projects share the same database; a single‑project OSS deployment still suffers from a more limited scope where ordering can be performed across features or environments within the default project.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score is not available, so current public data does not suggest a high exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploit requires an authenticated user with UPDATE_FEATURE_STRATEGY rights in any project and knowledge of other projects’ strategy IDs. The attacker can change the strategy evaluation order, potentially altering the behavior of features for end users, but the operation does not alter strategy parameters, constraints, or segments.