CVE-2026-86544

Knowns versions prior to 0.30.0 are affected by an authorization bypass vulnerability in the permissions system. Mutating code actions are incorrectly classified as read-only operations , allowing attackers holding read-restricted sessions to exploit code.replace to modify permission configuratio...

CVE-2026-86544 knowns before 0.30.0 Authorization Bypass via Misclassified Code Actions

knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-only operations. Attackers with read-restricted sessions can exploit code.replace to modify permission configurations and escalate privileges on subsequent...