knowns EUVD-2026-75582

Exploitation requires possession of a valid read-only agent session credential for the knowns server - any agent-level access suffices. The server must be reachable over the network (AV:N). No special configuration is needed beyond the default deployment, as the exemption is hardcoded unconditionally. What limits exploitation: the attacker must already have been granted some level of agent access (PR:L), making fully external unauthenticated attackers unable to exploit this directly. The attacker-chosen target directory must be accessible on the server's filesystem for the repoint to have meaningful effect.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L) scores 8.7, reflecting network-accessible exploitation with low attack complexity, no special requirements, but requiring at minimum a low-privilege agent session (PR:L). This distinguishes the flaw from fully unauthenticated attacks: an adversary must first obtain any read-only agent credential, which serves as the primary limiting factor. Confidentiality and integrity impacts are both rated high because the attacker can read and write within the attacker-chosen project directory. Availability impact is low (VA:L), consistent with no direct service disruption. No EPSS score is provided in the input data; the absence of KEV listing and publicly available exploit code further suggests this is not yet broadly targeted. Real-world priority is moderate: organizations granting read-only agent access to untrusted or semi-trusted parties face meaningful risk of write-access escalation.

An attacker who has obtained a read-only agent session - for example, a contractor or CI pipeline token - sends a project.set request pointing the server at a directory containing attacker-controlled files. Because the permission guard unconditionally skips this action, the request succeeds, and subsequent agent operations now target the attacker-chosen directory with write-level capabilities. No exploit code is publicly documented, but the exploitation path is straightforward given the bypass is hardcoded.