CVE-2026-86544

knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

7.2 High

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: High
Availability: High

Exploit likelihood

0.58%Up 0.3 points since Sep 8, 2026

What each source reports

CVE List Score used 7.2

knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

Record: CVE-2026-86544
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2026-72562 7.2

Record: EUVD-2026-72562
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q52j-357p-5pv8 7.2

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code...

Record: GHSA-q52j-357p-5pv8
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

NVD 7.2

Record: CVE-2026-86544
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

OSV 7.2

knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

Record: CVE-2026-86544
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-863
Updated: 2026-11-02

Affected products

knowns-dev knowns

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-86544 is a high vulnerability (CVSS 7.2) in Knowns-dev Knowns, published September 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. No source names a fixed version.