# CVE-2026-88939: Knowns project.set privilege escalation via permission bypass

Source: https://junglewise.ai/threats/cve-2026-88939-knowns-project-set-privilege-escalation-via-permission-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88939 · Severity: high · CVSS 8.3 · Published 2026-09-10

Knowns is an AI-powered project management and task execution platform. Versions through 0.33.0 contain a flaw that allows read-only user sessions to invoke the project.set action without restrictions, enabling them to redirect the server to a different project directory and gain write access. An attacker with read-only credentials can escalate privileges and modify data they should not be able to change.

## Quick answers

**Is CVE-2026-88939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88939 being exploited in the wild.

**How severe is CVE-2026-88939?** High severity, with a CVSS score of 8.3, published 10 September 2026.

**Which products and versions are affected?** Knowns Knowns through 0.33.0.

**Is there a fix for CVE-2026-88939?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-88939 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-88939?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in the permission guard middleware (guard.go). The project.set action is incorrectly exempted from permission checks, either through a bootstrap action classification or by being treated as a lifecycle action, bypassing the CheckCapability() gate. Read-only agent sessions can invoke project.set to repoint the server to an attacker-controlled project directory, circumventing permission restrictions. The attack requires network access to the Knowns server and the ability to make MCP tool calls as an authenticated (read-only) agent. A patch restricting project.set to administrative capabilities or explicitly enforcing write/admin checks on the action is required.

## Affected products

- Knowns Knowns through 0.33.0

## Timeline

- 2026-09-10: disclosed

## References

- [https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/permissions/guard.go](https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/permissions/guard.go)
- [https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/permissions/registry.go](https://github.com/knowns-dev/knowns/blob/v0.33.0/internal/permissions/registry.go)