CVE-2026-63458: Perses's project query parameter authorization bypass exposes cross-project resources

What kind of vulnerability is it?

An authenticated user who is only a viewer on project team-a requests GET /api/v1/projects/team-a/dashboards?project=finance-secret (or simply GET /api/v1/datasources?project=finance-secret) and receives the full list of the finance-secret project’s dashboards and datasource specifications, despite having no role on that project. This defeats Perses’ project-level tenant isolation for all project-scoped read resources.

Who is impacted?

Any authenticated user reads every project’s dashboards, datasources, variables across tenants.