CVE-2026-86544 — knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-r…
Published: 2026-09-07 · CVSS: 7.2 · CVSS 4.0
knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent calls.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7