CVE-2026-86544: knowns Authorization Bypass via Misclassified Code Actions
The permission system worked exactly as designed. It just had the wrong answer to the only question that mattered: is code.replace a read or a write?
taxonomy / tag
The permission system worked exactly as designed. It just had the wrong answer to the only question that mattered: is code.replace a read or a write?