THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-cjgj-2fwf-4c2w (high) — Perses's project query parameter authorization bypass exposes cross-project resources

[GHSA] GHSA-cjgj-2fwf-4c2w (high) — Perses's project query parameter authorization bypass exposes cross-project resources

medgithub_advisoriesPublished 2026-09-18

GHSA-cjgj-2fwf-4c2w Severity: high CVE: CVE-2026-63458

Perses's project query parameter authorization bypass exposes cross-project resources

### Impact _What kind of vulnerability is it?_

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the f

Indicators of compromise

CVE-2026-63458cve

Original source: https://github.com/advisories/GHSA-cjgj-2fwf-4c2w