An authorization bypass vulnerability in Knowns versions 0.33.0 and earlier allows authenticated low-privileged users to escalate their access to administrative levels.

This is an improper authorization flaw (CWE-863) where the project.set tool action is explicitly exempted from permission guard checks. An attacker with a low-privileged read-only agent session can invoke this action to bypass security controls and obtain unauthorized write access capabilities.

A successful exploit allows an attacker to repoint the server to arbitrary project directories, effectively granting them unauthorized write access to sensitive project data. Given the CVSS score of 8.3, this represents a significant risk to data integrity and system confidentiality. This vulnerability could be leveraged to manipulate project configurations, corrupt data, or gain persistence within the development environment.

Immediate Action: Upgrade to a version beyond 0.33.0 as soon as the vendor provides a security patch to address the bootstrap action exemption.

Proactive Monitoring: Monitor server access logs for anomalous usage of the project.set tool, especially when initiated by accounts that typically only require read-only access.

Compensating Controls: Implement strict network segmentation to limit access to the Knowns server and enforce the principle of least privilege for all agent sessions.

Public Exploit Available: No

The vulnerability presents a high risk of unauthorized administrative access to the Knowns platform. Organizations should prioritize identifying all instances of Knowns in their environment and monitor for suspicious project configuration changes. Once a fixed version is released by the vendor, it should be deployed immediately to close this authorization gap.