CVE-2026-63458

What it is

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project, which breaks project-level tenant isolation and exposes complete resource specifications belonging to other projects. This issue is fixed in version 0.54.0-beta.3.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure.

Exploit odds

0.4% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-18 18:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-23 18:12 UTC Last updatedMost recent change to the record

Details

Published

2026-09-18 18:17 UTC

Last modified

2026-09-23 18:12 UTC

Exploit probability

0.4% · EPSS, next 30 days

Weakness

CWE-639 · Insecure direct object reference

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 7.1

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None