The vulnerability stems from a logic error that treats mutating code actions as if they were read‑only. An attacker who possesses a session that allows only read operations can still trigger the code.replace endpoint, thereby altering the system’s permission configuration. This flaw effectively permits the attacker to elevate privileges on subsequent requests. The weakness is a classic example of Authorization Bypass Through Privilege Escalation (CWE-863).

All releases of the knowns-dev: knowns application prior to version 0.30.0 are affected. The issue was present in versions 0.29.x and earlier, as documented in the repository source files and the advisory references provided.

The CVSS score of 7.2 indicates a high severity vulnerability. No EPSS score is available, and the weakness has not been listed in the CISA KEV catalog. Attackers need only possession of read‑restricted credentials to exploit the flaw, suggesting that the attack vector is authenticated but not necessarily remote. The potential impact is the modification of permission settings, which can lead to unrestricted access or escalation to administrative privileges within the knowns application. The risk is significant for environments where read‑restricted access is granted to untrusted users or external services.