The Unleash administration API before version 8.0.3 contains several authorization flaws that allow an authenticated user to read or modify resources in projects they are not permitted to manage. The POST /api/admin/segments/strategies endpoint assigns the result of hasPermission without awaiting it, enabling users lacking UPDATE_FEATURE_STRATEGY permission to alter segment assignments for arbitrary projects and environments. Multiple GET endpoints expose cross‑project data because they do not validate that the referenced feature, strategy, or environment belongs to the supplied project ID. The PUT /:projectId/tags endpoint accepts feature identifiers without confirming membership in the specified project, allowing cross‑project tag modification. These weaknesses permit unauthorized disclosure of configuration, modification of feature flags, and operational disruption. This series of bugs culminates in a privilege escalation and information‑disclosure vulnerability that can be leveraged without the intention of executing arbitrary code.

Affected systems are sites running Unleash feature‑management platform prior to the 8.0.3 release. All administrative API endpoints that manipulate segments, strategies, variants, environment information, or tags are impacted, and these endpoints are available on any version before v8.0.3. Administrators and users with API access therefore must upgrade to 8.0.3 or later to eliminate the exposed flaws.

The CVSS score of 7.1 indicates high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that known exploitation is limited at present. However, based on the description, it is inferred that an attacker would target the admin API, exploiting the missing permission check or the unbound project identifiers via crafted authenticated requests. Because the flaws rely on incorrect validation and the attacker can simply supply arbitrary project IDs and feature names, the likelihood of exploitation is substantial if the admin API is reachable over the network. Consequently, the risk is high for organizations that expose the Unleash admin API to internal or external networks without stringent access controls.