Vulnerability-Lookup

GHSA-CJGJ-2FWF-4C2W

Vulnerability from github – Published: 2026-09-18 17:39 – Updated: 2026-09-18 17:40

Summary

Perses's project query parameter authorization bypass exposes cross-project resources

Details

Impact

What kind of vulnerability is it?

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.

Who is impacted?

Any authenticated user reads every project's dashboards, datasources, variables across tenants.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

None

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/perses/perses"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.54.0-beta.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63458"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T17:39:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Impact\n_What kind of vulnerability is it?_\n\nAn authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project\u0027s dashboards and datasource specifications, despite having no role on that project. This defeats Perses\u0027 project-level tenant isolation for all project-scoped read resources.\n\n_Who is impacted?_\n\nAny authenticated user reads every project\u0027s dashboards, datasources, variables across tenants.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\n### Workarounds\nNone",
  "id": "GHSA-cjgj-2fwf-4c2w",
  "modified": "2026-09-18T17:40:32Z",
  "published": "2026-09-18T17:39:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w"
    },
    {
      "type": "WEB",
      "url": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/perses/perses"
    },
    {
      "type": "WEB",
      "url": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Perses\u0027s project query parameter authorization bypass exposes cross-project resources"
}

CVE-2026-63458 (GCVE-0-2026-63458)

Vulnerability from cvelistv5 – Published: 2026-09-18 17:32 – Updated: 2026-09-18 19:50

Title

Perses project query parameter authorization bypass exposes cross-project resources

Summary

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-18 19:50 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/perses/perses/security/advisor…	x_refsource_CONFIRM
https://github.com/perses/perses/commit/8015fb340…	x_refsource_MISC
https://github.com/perses/perses/releases/tag/v0.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
perses	perses	Affected: < 0.54.0-beta.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63458",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T19:50:23.078796Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T19:50:33.901Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "perses",
          "vendor": "perses",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.54.0-beta.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller\u0027s authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:33:16.974Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w"
        },
        {
          "name": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540"
        },
        {
          "name": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/perses/perses/releases/tag/v0.54.0-beta.3"
        }
      ],
      "source": {
        "advisory": "GHSA-cjgj-2fwf-4c2w",
        "discovery": "UNKNOWN"
      },
      "title": "Perses project query parameter authorization bypass exposes cross-project resources"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63458",
    "datePublished": "2026-09-18T17:32:54.847Z",
    "dateReserved": "2026-07-16T21:37:45.768Z",
    "dateUpdated": "2026-09-18T19:50:33.901Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.