CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.

• CWE-639

• https://github.com/perses/perses/commit/8015fb340bdc625953e73a7a688be5b939159540
• https://github.com/perses/perses/releases/tag/v0.54.0-beta.3
• https://github.com/perses/perses/security/advisories/GHSA-cjgj-2fwf-4c2w

Published

Sep 18, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63452Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-63453Buffer overflow vulnerabilities exist in the command line in…7.2
• CVE-2026-63454An authenticated path traversal vulnerability exists in AOS-…7.2
• CVE-2026-63455Multiple vulnerabilities in the REST API interface of HPE Ne…9.8
• CVE-2026-63456Multiple vulnerabilities in the REST API interface of HPE Ne…9.8
• CVE-2026-63457A potential denial of service vulnerability exists in HPE In…6.5
• CVE-2026-63459Vendure is an open-source headless commerce platform. Prior …8.7
• CVE-2026-6346Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13, 1…8.7
• CVE-2026-63460Vendure is an open-source headless commerce platform. Prior …7.5
• CVE-2026-63461Vendure is an open-source headless commerce platform. Prior …5.3
• CVE-2026-63462Unleash is an open-source feature management platform. Prior…7.5
• CVE-2026-63464nebula-mesh is a self-hosted control plane for Slack Nebula …7.7