CVE-2026-88939

HighCVSS 8.3/10Last modified Sep 15, 2026

Description

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2026
Last modified: Sep 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-88946.4The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to,CVE-2026-889405.3knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate ar CVE-2026-889444.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i CVE-2026-88956.4The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up CVE-2026-889529.1Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAu CVE-2026-889566.8The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interf CVE-2026-889598.8Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-priv CVE-2026-88966.4The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attribu CVE-2026-889628.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code CVE-2026-889636.1The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_CVE-2026-889647.1An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia CVE-2026-88976.4The Shortcode Buddy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and in