CVE-2026-86544
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-o
CVSS
8.1
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 7, 2026 · Last modified: Sep 7, 2026 · CWE-863
Not enough EPSS history yet.
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
- github.comhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/permissions/guard.go#L44-L60
- github.comhttps://github.com/knowns-dev/knowns/blob/v0.29.1/internal/permissions/registry.go#L99-L140
- github.comhttps://github.com/knowns-dev/knowns/commit/a2c98fc5c313463576c9348beeec6a74ddd7333b
- github.comhttps://github.com/knowns-dev/knowns/releases/tag/v0.30.0
- github.comhttps://github.com/knowns-dev/knowns/security/advisories/GHSA-w323-3wpx-f7g5
- www.vulncheck.comhttps://www.vulncheck.com/advisories/knowns-before-0.30.0-authorization-bypass-via-misclassified-code-actions
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-864377.2 HIG—
———Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive containing modified application files such as routes/web.php with embedded system commands, which execute as the web server user with access to environment secrets and database credentials.4hCVE-2026-864987.7 HIG—
———In JetBrains YouTrack before 2025.3.160480,
2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission9hCVE-2026-864936.5 MED—
———In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards9hCVE-2026-864906.5 MED—
———In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint9hCVE-2026-864873.1 LOW—
———In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content9hCVE-2026-765607.5 HIG—
———A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.12h