CVE-2026-76909 in Unleash
Summary
by MITRE • 09/22/2026
Unleash is an open-source feature management platform. Prior to 8.0.3, the change-request approval email template at src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache renders the user-controlled changeRequestTitle, requesterName, and requesterEmail values without HTML escaping, and sendRequestedCRApprovalEmail passes those values to Mustache rendering. A project member who can create a change request when approval emails are enabled can inject HTML into an approver's notification, allowing forged links, tracking content, or visually altered email content. This issue is fixed in version 8.0.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
Unleash is an open-source feature management platform designed to help development teams manage feature flags and control the rollout of new functionality across applications. The vulnerability identified involves a critical flaw within its change-request approval workflow, specifically affecting versions prior to 8.0.3. This system allows project members to submit requests for changes that require approval from designated approvers via email notifications. The security issue stems from improper handling of user-supplied input during the rendering of these notification emails. Specifically, the Mustache template engine used in src/mailtemplates/requested-cr-approval/requested-cr-approval.html.mustache fails to apply HTML escaping when processing values such as changeRequestTitle, requesterName, and requesterEmail. These fields are passed directly from the sendRequestedCRApprovalEmail function into the rendering pipeline without sanitization or encoding checks.
The technical root cause of this vulnerability is a classic Cross-Site Scripting (XSS) flaw manifested within an email context, often referred to as Stored XSS if the malicious content persists in the database before being rendered. Because the application does not escape special HTML characters such as angle brackets, quotes, or ampersands when inserting user-controlled data into the email template, an attacker can inject arbitrary HTML and JavaScript code. This occurs because the Mustache engine treats unescaped input as raw markup rather than plain text. Consequently, any project member with the permission to create a change request while approval emails are enabled in their organization's configuration can exploit this weakness. By crafting a malicious payload within fields like the requester name or email address, an attacker ensures that when an approver views the notification, the embedded script executes in the context of the recipient's browser session if they open the email using a web-based mail client or preview pane that supports HTML rendering and script execution.
The operational impact of this vulnerability is significant for organizations relying on Unleash for secure feature management workflows. An attacker can forge links within the approval email to direct users to phishing sites designed to steal credentials or install malware. Additionally, the ability to inject tracking pixels allows attackers to monitor when an approver opens the email and potentially gather information about their device or location through image requests. Furthermore, visually altering the content of the notification can lead to social engineering attacks where approvers are tricked into approving malicious changes due to manipulated visual cues in the interface. This undermines the integrity of the change management process and poses a risk to both individual users and organizational security posture by facilitating credential theft or unauthorized access through deceptive means.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. It also relates to CWE-830 in cases where the injection leads to execution of unintended code via HTML attributes or event handlers embedded within the injected markup. From a threat intelligence perspective, this behavior maps to MITRE ATT&CK technique T1566.002, which covers Spearphishing Link attacks under Initial Access vectors. The exploitation relies on social engineering combined with technical injection to compromise user trust and system integrity. To mitigate this risk, organizations must upgrade Unleash to version 8.0.3 or later where the rendering logic has been corrected to properly escape all dynamic content before insertion into HTML templates. Until an upgrade is performed, administrators should consider disabling email notifications for change requests if feasible, restricting who can create such requests to trusted individuals only, and ensuring that any mail clients used by approvers do not automatically render untrusted HTML or execute scripts from external sources. Regular security audits of template rendering logic are recommended to prevent similar input validation failures in other parts of the application.