CVE-2026-86544
published 2026-09-07CVE-2026-86544: knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations…
PriorityP354high8.1CVSS 3.1
AVNACLPRLUINSUCNIHAH
EPSS
0.58%
45.8th percentile
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| knowns-dev | knowns | < 0.30.0 | 0.30.0 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvdv4.07.2HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations.
ghsa_unreviewed·2026-09-08
CVE-2026-86544 [HIGH] CWE-863 knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations.
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
VulDB
knowns-dev knowns up to 0.29.x Code Actions code.replace authorization
vuldb·2026-09-08·CVSS 8.1
CVE-2026-86544 [HIGH] knowns-dev knowns up to 0.29.x Code Actions code.replace authorization
A vulnerability, which was classified as problematic, has been found in knowns-dev knowns up to 0.29.x. This affects the function code.replace of the component Code Actions. Performing a manipulation results in authorization bypass.
This vulnerability is reported as CVE-2026-86544. The attack is possible to be carried out remotely. No exploit exists.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/permissions/guard.go#L44-L60https://github.com/knowns-dev/knowns/blob/v0.29.1/internal/permissions/registry.go#L99-L140https://github.com/knowns-dev/knowns/commit/a2c98fc5c313463576c9348beeec6a74ddd7333bhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0https://github.com/knowns-dev/knowns/security/advisories/GHSA-w323-3wpx-f7g5https://www.vulncheck.com/advisories/knowns-before-0.30.0-authorization-bypass-via-misclassified-code-actions
2026-09-07
Published