Description

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-07T23:16:54.303Z",
  "pubdate": "2026-09-07T23:16:54.303Z",
  "executiveSummary": "This vulnerability involves an authorization bypass flaw identified in versions of knowns prior to 0.30.0. The security failure stems from the improper classification of mutating code actions as read-only operations within the application's access control logic. By failing to correctly distinguish between state-changing operations and read-only requests, the system inadvertently permits unauthorized users to execute privileged functions. Attackers possessing sessions with read-only restrictions can exploit this flaw to perform unauthorized modifications, specifically leveraging the code.replace function. This failure in the authorization layer enables an escalation of privileges, as attackers can manipulate permission configurations or modify critical system code to gain elevated access. The vulnerability poses a significant risk to the integrity and confidentiality of the application, as it effectively nullifies existing session-level security constraints, allowing for unauthorized state changes that can be leveraged for full system compromise.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic error within the internal request handler of knowns, where mutating operations are incorrectly categorized as read-only. Specifically, the application fails to perform an adequate authorization check before executing the code.replace function, assuming that the invoked action falls under the scope of restricted, non-mutating operations. This misclassification creates an inconsistency between the security policy defined for the session and the actual execution path allowed by the application controller.\nThe exploitation flow begins with an attacker obtaining a session restricted to read-only access. Despite these restrictions, the attacker identifies that the server-side logic processes code.replace requests without validating the mutation intent of the call. By crafting a request that utilizes the code.replace function, the attacker bypasses the intended authorization gate. The server, misidentifying this action as a standard read-only data retrieval, proceeds to execute the function with the provided payload.\nThe primary mechanism of exploitation involves the manipulation of permission-defining objects or configuration files. Because code.replace enables the modification of arbitrary code segments, an attacker can target the application's authorization logic, such as modifying internal ACL (Access Control List) tables, overriding security checks, or elevating their own session privileges. Once the underlying code is modified via code.replace, subsequent calls made by the attacker are processed with the newly altered, higher-level permissions.\nThe vulnerable component is the internal action-dispatching mechanism responsible for verifying the scope and permission level of incoming requests. All versions prior to 0.30.0 are confirmed to be affected. The attack requires an existing, albeit restricted, session; however, no specific network exposure beyond reachability of the API endpoint is required. Post-exploitation, the attacker achieves persistence or full administrative control by permanently altering the application's permission schema, facilitating a complete bypass of the initial security posture."
}