Summary
Perses's project query parameter authorization bypass exposes cross-project resources
Advisory details
Impact
What kind of vulnerability is it?
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
Who is impacted?
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
Patches
Has the problem been patched? What versions should users upgrade to?
Workarounds
None
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-107850
Contao: Improper access control in the preview links module
- MEDIUMCVE-2026-91980
Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
- MEDIUMCVE-2026-91984
Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
- HIGHCVE-2026-91985
Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level
- HIGHCVE-2026-76216
Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
- CRITICALCVE-2026-68582
Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)