CVE-2026-63458: Perses project query parameter authorization bypass exposes cross-project resources
Impact What kind of vulnerability is it?
An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.
Who is impacted?
Any authenticated user reads every project's dashboards, datasources, variables across tenants.
Patches Has the problem been patched? What versions should users upgrade to?
Workarounds None
Other sources
Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/perses/persesto a version that resolves this vulnerability.Fixed in 0.54.0-beta.3 - Upgrade
Upgrade
Persesto a version that resolves this vulnerability.Fixed in 0.54.0-beta.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with viewer access to at least one project can exploit it. They can request resources from another project by supplying that project's value through the project query parameter on affected project-scoped list endpoints.
What information may be exposed?
The issue can expose complete resource specifications from other projects, including dashboards, datasources, and variables. This breaks project-level tenant isolation.
Which deployments are affected?
Perses versions prior to 0.54.0-beta.3 are affected. The issue is fixed in version 0.54.0-beta.3.
How can administrators identify potential exposure?
Review requests to affected project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources, for cases where the request-controlled project value differs from a project the authenticated caller is authorized to access.