Most recent entries from all

fkie_cve-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.

GHSA-cjgj-2fwf-4c2w — Perses's project query parameter authorization bypass exposes cross-project resources

Affected: Go: github.com/perses/perses

### Impact _What kind of vulnerability is it?_

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.

_Who is impacted?_

Any authenticated user reads every project's dashboards, datasources, variables across tenants.

### Patches _Has the problem been patched? What versions should users upgrade to?_

### Workarounds None

openSUSE-SU-2026:11413-1 — perses-cli-0.54.0-1.1 on GA media

perses-cli-0.54.0-1.1 on GA media