GHSA-cjgj-2fwf-4c2w

Source

https://github.com/advisories/GHSA-cjgj-2fwf-4c2w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cjgj-2fwf-4c2w/GHSA-cjgj-2fwf-4c2w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cjgj-2fwf-4c2w

Aliases

CVE-2026-63458

Published

2026-09-18T17:39:31Z

Modified

2026-09-18T17:45:05Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Perses's project query parameter authorization bypass exposes cross-project resources

Details

Impact

What kind of vulnerability is it?

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.

Who is impacted?

Any authenticated user reads every project's dashboards, datasources, variables across tenants.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

None

Database specific

{
    "cwe_ids": [
        "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:39:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/perses/perses

Package

Name: github.com/perses/perses; View open source insights on deps.dev
Purl: pkg:golang/github.com/perses/perses

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.54.0-beta.3

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-cjgj-2fwf-4c2w/GHSA-cjgj-2fwf-4c2w.json"