Knowstreaming
Monthly
Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.
KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Missing authorization checks in DiDi KnowStreaming through 3.4.1 allow any authenticated user - regardless of assigned role - to reach protected REST API functionality, including identity-management endpoints that can create administrator accounts or elevate the caller's own privileges. Exploitation requires only a valid low-privilege login (PR:L) with network reach to the REST API; no admin role, user interaction, or non-default configuration is needed, which makes the flaw most dangerous in deployments where accounts are broadly provisioned or self-registration is enabled. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation, but the complete loss of confidentiality, integrity, and availability on affected systems keeps this a genuinely high-priority privilege-escalation issue.
KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.