Executive brief
Knowns is an AI-powered project management and task execution platform. Versions through 0.33.0 contain a flaw that allows read-only user sessions to invoke the project.set action without restrictions, enabling them to redirect the server to a different project directory and gain write access. An attacker with read-only credentials can escalate privileges and modify data they should not be able to change.
Technical details
The vulnerability is an authorization bypass in the permission guard middleware (guard.go). The project.set action is incorrectly exempted from permission checks, either through a bootstrap action classification or by being treated as a lifecycle action, bypassing the CheckCapability() gate. Read-only agent sessions can invoke project.set to repoint the server to an attacker-controlled project directory, circumventing permission restrictions. The attack requires network access to the Knowns server and the ability to make MCP tool calls as an authenticated (read-only) agent. A patch restricting project.set to administrative capabilities or explicitly enforcing write/admin checks on the action is required.
Affected products
- Knowns Knowns through 0.33.0
Timeline
- 2026-09-10: disclosed