AutoGPT CVE-2026-30950

Requires an authenticated AutoGPT account on a vulnerable instance running version 0.6.36 through 0.6.50 with the session management API reachable, and the attacker must know or be able to obtain the session_id of a target session in order to invoke PATCH /sessions/{session_id}/assign-user. The attack is limited by the need for any valid login (PR:L, not PR:N) and by the practical difficulty of learning another user's session_id - if session IDs are high-entropy and not leaked through URLs, logs, or other channels, exploitation effectively becomes opportunistic against IDs the attacker happens to observe rather than fully blind. No user interaction by the victim is needed, and no special non-default configuration is described as required.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L scores 7.1 (High) and is internally consistent with the description: network-reachable HTTP endpoint, low attack complexity, low-privileged authenticated attacker, no user interaction, full confidentiality loss of the hijacked session's content, no integrity impact on system data, and limited availability impact (the original owner is locked out of that session). EPSS data was not provided and the CVE is not listed in CISA KEV; combined with no public exploit identified at time of analysis, this reads as a credible but not yet widely weaponized issue. The main residual uncertainty is how easily session_id values can be enumerated or leaked in real deployments - if they are sequential or otherwise predictable, real-world risk rises sharply; if they are high-entropy UUIDs, the IDOR is gated by an information-disclosure precondition that is not described in the available data and should be verified against the source.

An attacker registers or already holds a low-privilege AutoGPT account, learns or guesses a target user's session_id (for example via a leaked URL, log entry, support ticket, or enumeration if IDs are predictable), and issues a PATCH request to /sessions/{session_id}/assign-user with their own credentials. The backend authenticates the request, calls the session lookup with user_id=None, skips the ownership check, and reassigns ownership of the victim's session to the attacker, who then reads its conversation history and effectively logs the victim out of that session. No public exploit identified at time of analysis, but the patch commit makes the exact mismatched call site trivially discoverable.