{"uuid": "2e8201fc-8957-400c-8ce3-fef50574acd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-cjgj-2fwf-4c2w", "type": "seen", "source": "https://gist.github.com/alon710/0b31ec47bc74ca943ea96e388e1d1f47", "content": "# CVE-2026-63458: CVE-2026-63458: Broken Object Level Authorization (BOLA) and Tenant Isolation Bypass in Perses\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-18\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63458\n\n## Summary\nAn authorization bypass and tenant isolation vulnerability in Perses prior to version 0.54.0-beta.3 allows authenticated viewers to access unauthorized project resources by manipulating query parameters or querying unmapped ephemeral endpoints.\n\n## TL;DR\nAuthenticated users with viewer access can bypass tenant boundaries and view configurations of unauthorized projects due to inconsistent parameter evaluation in Perses backend services.\n\n## Technical Details\n\n- **CWE ID**: CWE-639\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 7.1\n- **EPSS Score**: 0.0\n- **Impact**: Confidentiality High (VC:H)\n- **Exploit Status**: none\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Perses Observability Platform\n- **perses**: < 0.54.0-beta.3 (Fixed in: `0.54.0-beta.3`)\n\n## Mitigation\n\n- Upgrade to version 0.54.0-beta.3 or later\n- Deploy WAF rules to detect and drop mismatched path/query parameters\n- Monitor application logs for HTTP 400 validation failures\n\n**Remediation Steps:**\n1. Identify all deployed Perses instances running versions older than 0.54.0-beta.3\n2. Apply the patch by updating the container image or application binary to version 0.54.0-beta.3\n3. Verify access controls by attempting a cross-project query using an authorized account\n4. Review access logs for occurrences of mismatched 'project' values\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w)\n- [Remediation Fix Commit](https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540)\n- [Release Tag Details](https://github.com/perses/perses/releases/tag/v0.54.0-beta.3)\n- [NVD Vulnerability Record](https://nvd.nist.gov/vuln/detail/CVE-2026-63458)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-63458)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63458) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-19T06:32:20.282761Z"}