Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-86544

CVE-2026-86544: Knowns Authorization Bypass Vulnerability

CVE-2026-86544 is an authorization bypass flaw in knowns that allows attackers with read-only access to escalate privileges by exploiting misclassified code actions. This post covers technical details, affected versions, and mitigation.

Published:

CVE-2026-86544 Overview

CVE-2026-86544 is an authorization bypass vulnerability in the Knowns platform affecting versions before 0.30.0. The flaw stems from mutating code actions being incorrectly classified as read-only operations in the permission registry. Attackers holding read-restricted sessions can invoke code.replace to modify permission configurations. Once permissions are rewritten, subsequent calls execute with elevated privileges. The issue is tracked under CWE-863: Incorrect Authorization and disclosed in GitHub Security Advisory GHSA-w323-3wpx-f7g5.

Critical Impact

Low-privileged users can escalate to full write and delete privileges by abusing a misclassified code mutation action, resulting in high integrity and availability impact on the affected system.

Affected Products

  • Knowns versions prior to 0.30.0
  • Reference vulnerable build: Knowns v0.29.1
  • Fixed release: Knowns v0.30.0

Discovery Timeline

  • 2026-09-07 - CVE-2026-86544 published to NVD
  • 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86544

Vulnerability Analysis

The Knowns permission system enforces access decisions through a central registry mapping action names to capability metadata. Each action carries a Capability value such as CapRead, CapWrite, or CapDelete, along with a target and risk rating. The permission guard in internal/permissions/guard.go evaluates these values to decide whether a session may execute the requested action.

In versions before 0.30.0, the registry defined a limited set of code.* actions and omitted several mutating operations. Actions that modified source or configuration data were either missing or defaulted to a read classification. As a result, a session limited to read-only capabilities could invoke code.replace and rewrite permission configuration values. The attacker then escalates on subsequent requests using the newly granted capability.

Root Cause

The root cause is an incorrect authorization mapping in internal/permissions/registry.go. Mutating code actions were treated as CapRead operations. The guard therefore approved write-class calls for read-restricted principals, breaking the intended capability boundary.

Attack Vector

Exploitation requires an authenticated session with low privileges over the network. No user interaction is needed. The attacker calls code.replace to alter permission configurations, then reissues subsequent calls that now succeed under the elevated capability set.

go
 	"search.resolve":  {Capability: CapRead, Target: TargetSearch, Risk: RiskLow},
 
 	// code
-	"code.search":  {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
-	"code.symbols": {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
-	"code.deps":    {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
-	"code.graph":   {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.search":          {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.symbols":         {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.deps":            {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.graph":           {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.find":            {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.definition":      {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.references":      {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.implementations": {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.diagnostics":     {Capability: CapRead, Target: TargetCode, Risk: RiskLow},
+	"code.rename":          {Capability: CapWrite, Target: TargetCode, Risk: RiskHigh},
+	"code.replace":         {Capability: CapWrite, Target: TargetCode, Risk: RiskHigh},
+	"code.replace_body":    {Capability: CapWrite, Target: TargetCode, Risk: RiskHigh},
+	"code.insert":          {Capability: CapWrite, Target: TargetCode, Risk: RiskHigh},
+	"code.delete":          {Capability: CapDelete, Target: TargetCode, Risk: RiskHigh},
 
 	// templates
 	"templates.create": {Capability: CapWrite, Target: TargetTemplate, Risk: RiskMedium},

Source: GitHub commit a2c98fc5. This patch explicitly registers code.rename, code.replace, code.replace_body, code.insert, and code.delete as write or delete class capabilities with RiskHigh, ensuring the guard rejects them for read-restricted sessions.

Detect Identity Attacks the Moment Authentication Fails

Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.

Stop Identity Attacks

Detection Methods for CVE-2026-86544

Indicators of Compromise

  • Successful code.replace, code.replace_body, code.insert, code.rename, or code.delete requests from sessions provisioned as read-only.
  • Unexpected modifications to permission configuration files or registry entries on Knowns hosts running versions below 0.30.0.
  • Sequences where a low-privileged principal executes a code.* mutation followed by previously denied write operations that now succeed.

Detection Strategies

  • Audit application logs for code.* actions correlated against the invoking principal's assigned role and expected capability set.
  • Diff permission configuration state before and after code.* mutation calls to identify unauthorized privilege changes.
  • Deploy runtime rules that flag any principal invoking mutation actions without a corresponding write capability grant.

Monitoring Recommendations

  • Forward Knowns application and permission subsystem logs to a centralized analytics platform for correlation and retention.
  • Alert on privilege changes issued by non-administrator accounts, especially those preceded by code.replace calls.
  • Track deployed Knowns versions across the environment and flag any host still running a release below 0.30.0.

How to Mitigate CVE-2026-86544

Immediate Actions Required

  • Upgrade all Knowns deployments to version v0.30.0 or later without delay.
  • Review permission configurations for unauthorized modifications made prior to patching and revert any suspicious changes.
  • Rotate credentials and session tokens for accounts that may have exploited or been abused via the misclassified actions.

Patch Information

The fix is delivered in commit a2c98fc5 and released in Knowns v0.30.0. The patch reclassifies code.rename, code.replace, code.replace_body, and code.insert as CapWrite with RiskHigh, and code.delete as CapDelete with RiskHigh. See the VulnCheck advisory for additional context.

Workarounds

  • Restrict network access to Knowns instances so only trusted, authenticated principals can reach the API surface.
  • Disable or block routing to the code.replace, code.replace_body, code.insert, code.rename, and code.delete endpoints until the upgrade is applied.
  • Remove low-trust user access from any Knowns instance that cannot be immediately upgraded to v0.30.0.
bash
# Verify installed Knowns version and upgrade if below 0.30.0
knowns version
# Example upgrade via Go module tooling
go install github.com/knowns-dev/knowns/cmd/knowns@v0.30.0

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne