KnowStreaming versions up to and including 3.4.1 fail to enforce role-based access control on certain REST API endpoints. This missing authorization flaw permits any authenticated user to invoke identity-management functions, enabling unauthorized creation of administrator accounts or privilege escalation. The vulnerability has a CVSS 4.0 base score of 8.7, indicating high severity with network attack vector, low attack complexity, no user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker with any authenticated access can bypass authorization controls to perform administrative actions, such as creating new administrator accounts or granting themselves administrative privileges. This compromises the security of the system by allowing unauthorized privilege escalation and potential full control over the affected KnowStreaming instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to trusted users only and monitor for suspicious activity related to identity-management endpoints.