A critical missing authorization vulnerability in Didi KnowStreaming allows any authenticated user to escalate privileges and gain full administrative control over the application.

The application fails to properly implement role-based access control (RBAC) within its REST API interceptor logic, specifically identified within the PermissionInterceptor class. This flaw permits any authenticated user to access sensitive identity-management endpoints, enabling them to create new administrator accounts or modify existing permissions without authorization.

Successful exploitation of this vulnerability results in full administrative compromise of the KnowStreaming platform. An attacker with standard user access can gain complete control over the system, potentially leading to unauthorized data access, configuration tampering, and total loss of system integrity. Given the CVSS score of 8.8, this represents a high-severity risk that could severely impact business operations and the security of the underlying data infrastructure.

Immediate Action: Review the official Didi KnowStreaming repository for the latest security release or vendor-provided patches that address the RBAC enforcement within the REST API.

Proactive Monitoring: Monitor API access logs for suspicious requests to identity-management endpoints, particularly those originating from non-administrative user accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to administrative API paths, effectively acting as a virtual patch until the software is updated.

Public Exploit Available: Unknown

This vulnerability presents a significant security risk due to the potential for total administrative takeover. Organizations running affected versions of KnowStreaming should prioritize updating the software as soon as a fix is made available. Until an official patch is applied, strict monitoring of administrative API calls is essential to detect and prevent unauthorized escalation attempts.