Perses Authorization Bypass Exposes Cross-Project Resources

The GitHub Security Advisory database has disclosed a high-severity vulnerability in the perses/perses project, identified as GHSA-cjgj-2fwf-4c2w. The issue involves an authorization bypass affecting the project query parameter in API endpoints. An authenticated user with viewer access to one project can exploit this flaw to retrieve dashboards, datasource specifications, and variables from other projects, bypassing tenant isolation intended to restrict access to project-scoped resources.

The vulnerability impacts all authenticated users, allowing unauthorized access to sensitive data across projects. No workaround is currently available, and users are advised to monitor for patches addressing this issue.

Operators should assess the risk of unauthorized data exposure in their environments, especially if sensitive or regulated information is stored in dashboards or datasources. Before upgrading, confirm whether the patch fully restores tenant isolation and verify its compatibility with existing configurations. This vulnerability highlights the importance of rigorous access control testing in multi-tenant systems.