A critical authorization bypass vulnerability in Knowns allows authenticated attackers to perform unauthorized code modifications and escalate privileges.

The application incorrectly classifies certain mutating code actions, such as code.replace, as read-only operations within its permission registry. This flaw allows an authenticated user with restricted read-only access to perform unauthorized write operations, potentially leading to privilege escalation by modifying permission configurations.

Successful exploitation of this vulnerability permits unauthorized modification of sensitive permission logic, effectively bypassing the intended security model of the application. Given the CVSS score of 8.1, this is a high-severity issue that could result in complete compromise of the authorization boundary, unauthorized access to sensitive system resources, and potential data manipulation.

Immediate Action: Update the Knowns installation to version 0.30.0 or later, which addresses the incorrect classification of code actions in the permission registry.

Proactive Monitoring: Review audit logs for unexpected code.replace operations or other unauthorized attempts to modify permission configurations by low-privileged user accounts.

Compensating Controls: If immediate patching is not feasible, restrict access to the affected environment and implement strict network-level controls to limit the reach of accounts with read-restricted sessions.

Public Exploit Available: Unknown

This vulnerability represents a significant failure in the application's core permission enforcement mechanism. Organizations using Knowns should prioritize upgrading to version 0.30.0 immediately to restore the integrity of the authorization system and prevent potential privilege escalation attacks.