CVE-2026-86544

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-86544

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86544.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-86544

Aliases

GHSA-w323-3wpx-f7g5

Published

2026-09-07T23:03:21Z

Modified

2026-10-28T02:30:38Z

Severity

7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

Details

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86544.json"
}

References

Affected packages

Git / github.com/knowns-dev/knowns

Affected ranges

Type

GIT

Repo

https://github.com/knowns-dev/knowns

Events

Introduced

Fixed

cead30b2c3a34f66c0c40cb692ed51e588e63bd7

Fixed

a2c98fc5c313463576c9348beeec6a74ddd7333b

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.30.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "a2c98fc5c313463576c9348beeec6a74ddd7333b"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v0.30.0",
            "range": [
                {
                    "fixed": "cead30b2c3a34f66c0c40cb692ed51e588e63bd7"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

v0.*

v0.1.1

v0.1.2

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.1.8

v0.10.0

v0.10.1

v0.10.2

v0.10.3

v0.10.4

v0.10.5

v0.10.6

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.12.0

v0.12.1

v0.12.2

v0.12.3

v0.12.4

v0.15.0

v0.15.1

v0.15.2

v0.15.3

v0.16.0

v0.16.1

v0.16.2

v0.16.3

v0.17.0

v0.17.1

v0.18.0

v0.18.1

v0.18.2

v0.18.3

v0.18.4

v0.19.0

v0.19.1

v0.19.2

v0.2.0

v0.2.1

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.20.5

v0.21.0

v0.22.0

v0.22.1

v0.22.2

v0.23.0

v0.24.0

v0.24.1

v0.25.0

v0.26.0

v0.27.0

v0.27.1

v0.28.0

v0.29.0

v0.29.1

v0.3.0

v0.3.1

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.8.0

v0.8.1

v0.8.2

v0.8.3

v0.8.4

v0.8.5

v0.8.6

v0.8.7

v0.8.8

v0.8.9

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-86544.json"