Skip to content
CVE IDCVE-2026-63458GitHub advisory IDGHSA-cjgj-2fwf-4c2w

Perses's project query parameter authorization bypass exposes cross-project resources

CVE-2026-63458 (GitHub advisory GHSA-cjgj-2fwf-4c2w) is a high-severity vulnerability with a CVSS 4.0 base score of 7.1, classed as Authorization Bypass Through User-Controlled Key (CWE-639), in github.com/perses/perses (Go). Affected versions: < 0.54.0-beta.3. It is fixed in 0.54.0-beta.3.

High7.1Fix availableGitHub reviewed

Published 18 Sept 2026Updated 18 Sept 2026

7.1HighCVSS 4.0
CVE ID
CVE-2026-63458
GHSA ID
GHSA-cjgj-2fwf-4c2w
EPSS
0.3%higher than 23% of CVEs
Weakness (CWE)
  • CWE-639Authorization Bypass Through User-Controlled Key
KEV status
Not in KEV
Published
18 Sept 2026
Updated
18 Sept 2026
Ecosystem
  • Go
Assigned by (CNA)
GitHub_M

Summary

Source: OSV (GitHub advisory)

Impact

What kind of vulnerability is it?

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project's dashboards and datasource specifications, despite having no role on that project. This defeats Perses' project-level tenant isolation for all project-scoped read resources.

Who is impacted?

Any authenticated user reads every project's dashboards, datasources, variables across tenants.

Patches

Has the problem been patched? What versions should users upgrade to?

Workarounds

None

Technical details

Source: GitHub Advisory Database

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

High7.1Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Attack Requirements AT
None
Privileges Required PR
Low
User Interaction UI
None
Confidentiality (Vulnerable System) VC
High
Integrity (Vulnerable System) VI
None
Availability (Vulnerable System) VA
None
Confidentiality (Subsequent Systems) SC
None
Integrity (Subsequent Systems) SI
None
Availability (Subsequent Systems) SA
None

CISA SSVC decision points

Exploitation
none
No public exploitation evidence
Automatable
no
Needs manual steps per target
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • github.com/perses/perses
    Go
    pkg:golang/github.com/perses/perses
    Affected versions
    < 0.54.0-beta.3
    Fixed in
    0.54.0-beta.3

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 0.54.0-beta.3 or later.

Patch commits

  • 8015fb3Patch commitgithub.com/perses/perses

    Merge commit from fork

    +241 −325 across 30 files

    • internal/api/database/model/dao.go+5 −0
    • internal/api/impl/v1/dashboard/service.go+8 −36
    • internal/api/impl/v1/datasource/service.go+6 −22
    • internal/api/impl/v1/ephemeraldashboard/service.go+8 −35
    • internal/api/impl/v1/folder/service.go+8 −36
    • internal/api/impl/v1/globaldatasource/service.go+4 −4
    • internal/api/impl/v1/globalrole/service.go+4 −4
    • internal/api/impl/v1/globalrolebinding/service.go+4 −4
    • and 22 more files

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 823d025Release commit0.54.0-beta.3github.com/perses/perses

Vulnerability intelligence

References

Credits

Questions about CVE-2026-63458

What is the GHSA ID for CVE-2026-63458?
GitHub tracks CVE-2026-63458 as GHSA-cjgj-2fwf-4c2w.
What is the CVSS score of CVE-2026-63458?
CVE-2026-63458 has a CVSS 4.0 base score of 7.1 (High), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
Which versions are affected by CVE-2026-63458?
github.com/perses/perses (Go): < 0.54.0-beta.3.
How do I fix CVE-2026-63458?
Upgrade to 0.54.0-beta.3 or later. The fix is in commit 8015fb3.
What is the Package URL (PURL) for CVE-2026-63458?
The affected package's PURL is pkg:golang/github.com/perses/perses.
Is CVE-2026-63458 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-63458. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.3% chance of exploitation in the next 30 days, higher than 23% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (14 Oct 2026, 17:49 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.