highCVE-2026-63458Sep 18, 2026

CVE-2026-63458: Perses Project Query Parameter Authorization Bypass

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any authenticated Perses user can read dashboards, datasources, and variables from projects they have no access to, just by adding a ?project= query parameter to a standard API request.

Packagegithub.com/perses/perses
Ecosystemgo
Affected< 0.54.0-beta.3
Fixed in0.54.0-beta.3

The problem

Perses enforces project-level RBAC so users only see resources inside projects they belong to. But list endpoints like GET /api/v1/projects/{project}/dashboards and GET /api/v1/datasources also accepted a ?project= query parameter, and the server used that parameter to scope the database query without checking whether the caller held any role in the named project.

The result: a viewer on project team-a can enumerate every dashboard, datasource, and variable in any other project, including ones that store sensitive connection credentials. All authenticated users are affected regardless of their role.

Proof of concept

A working proof-of-concept for CVE-2026-63458 in github.com/perses/perses, with the exact payload below.

http
GET /api/v1/projects/team-a/dashboards?project=finance-secret HTTP/1.1
Host: perses.example.internal
Authorization: Bearer <viewer-token-for-team-a>

The server's list handler extracted the project name from the ?project= query parameter and passed it directly to the storage layer as the query scope. The authorization check only validated the caller's role against the path-parameter project (team-a), never against the query-parameter project (finance-secret).

This is a textbook CWE-639 (Authorization Bypass Through User-Controlled Key): the caller controls the key used to look up data, and the server trusts it without re-running an authorization check.

The patch (commit 8015fb3) corrects this by ignoring or validating the ?project= query parameter against the authenticated user's actual permissions, so a caller cannot substitute an arbitrary project name to widen the scope of a listing operation.

The fix

Upgrade to Perses v0.54.0-beta.3 or later. No workaround exists for earlier versions. After upgrading, list endpoints will reject or ignore any ?project= value that the caller does not have an explicit role on.

Reporter not attributed.

References: [1][2][3][4]

Related research