KnowStreaming CVE-2026-92780

Requires a valid authenticated KnowStreaming account of any privilege level (PR:L) with network reach to the REST API - the interceptor (PermissionInterceptor.java) does not enforce role-based checks on protected endpoints, so no admin role, user interaction, or non-default configuration is needed beyond having a login. The limiting factor is the authentication requirement: fully anonymous exploitation is not possible, so realistic risk is highest where low-privilege accounts are broadly provisioned, self-registration is enabled, or credentials are otherwise obtainable. Affects all versions of didi KnowStreaming from 0 through 3.4.1.

This is a genuinely high-priority privilege-escalation flaw despite the absence of exploitation telemetry. The vendor CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) is internally consistent with the description: network-reachable REST API, low attack complexity, and a low-privilege authenticated starting point that yields full confidentiality, integrity, and availability impact once the attacker self-grants admin. The single hard gate is PR:L - an attacker needs any valid, even minimally-privileged, account. There is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis'; the risk here is driven by the low technical bar (CWE-862 missing authorization is trivially exploitable once discovered, e.g. by direct calls to identity-management endpoints), not by observed activity. No SSVC decision data was provided. The signals are not conflicting - they simply reflect a real but not-yet-weaponized issue: high inherent exploitability offset by a niche deployment footprint and an authentication precondition. Root-cause location is precisely identified (PermissionInterceptor.java lines 46-74 in the v3.4.0 source), which strengthens confidence that this is a real, verified authorization gap rather than a speculative report.

An attacker who holds any low-privilege KnowStreaming account (or registers/obtains one) sends crafted REST API requests directly to identity-management endpoints that the PermissionInterceptor fails to guard by role. Because RBAC is not enforced server-side, the attacker creates a new administrator account or elevates their own user to admin, then uses full administrative control over the Kafka management platform. No public exploit code is identified, but the flaw requires no special tooling - ordinary authenticated API calls suffice.