EUVD-2026-91704
GHSA-q43w-q4wm-h8j4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user in any org
-
ExploitIdentify or enumerate victim project_id
-
ExecutionCall agent controller endpoint with foreign project_id
-
ImpactCreate/stop/delete victim org's agents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated account in any organization on a shared, multi-tenant SuperAGI v0.0.14-or-earlier deployment (PR:L), and the attacker must know or enumerate the project_id of a project owned by a different organization. The specific prerequisite is that the controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter without checking that it belongs to the caller's organization. Limiting factors: it is not remote-unauthenticated (an account is needed), it has no effect on single-organization/single-tenant installations, and the attacker needs the target project_id; there is no confidentiality read primitive, so impact is confined to tampering with and disrupting the victim org's agents. |
| Impact | This is a moderate, authenticated broken-access-control (IDOR) flaw, not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) and the SSVC framework agree it is network-reachable and low-complexity but requires privileges (PR:L) - an attacker must already hold a valid authenticated account in some organization on the instance. SSVC rates Exploitation as 'poc', Automatable as 'no', and Technical Impact as 'partial', which is internally consistent: a public exploit exists but the attack is not self-propagating and yields only partial impact. No EPSS score and no CISA KEV entry were provided, so there is no evidence of widespread or active exploitation - publicly available exploit code exists, but that is a distinct signal from in-the-wild use. The main tension is the scope of impact: the input vector marks A:N (no availability impact), yet the description explicitly lists 'delete' and 'stop' operations against another organization's agents, which realistically causes availability loss for the victim tenant and suggests the published score slightly understates impact. Overall: a real but bounded multi-tenant authorization bug warranting prompt patching on shared/multi-org SuperAGI deployments rather than drop-everything urgency. |
| Exploit ScenarioDerived | A legitimate authenticated user belonging to organization A targets a multi-tenant SuperAGI instance and sends a crafted request to a controller endpoint (e.g. /api/agents/delete or /api/agents/edit_schedule) supplying a project_id that belongs to organization B. Because the endpoints never verify that the project_id belongs to the caller's organization, the attacker can create, reschedule, stop, or delete organization B's agents. A public proof-of-concept is referenced in a GitHub gist, and the attack is a simple low-complexity network request requiring no user interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Broken access control in SuperAGI v0.0.14 and earlier lets any authenticated user in one organization create, schedule, edit, stop, or delete agents belonging to a different organization's project. The controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) accept a project_id parameter but never verify that the referenced project belongs to the caller's organization, so an attacker who knows or can enumerate a foreign project_id can tamper with and disrupt another tenant's agents. CISA's SSVC assessment records that publicly available exploit code exists (Exploitation: poc), while the impact is rated partial because there is no confidentiality read primitive; this is a moderate, authenticated IDOR-style flaw that only matters on shared, multi-tenant deployments and is a non-issue on single-org installations.
RemediationAI
No vendor-released patch was identified at the time of analysis: the available references are an upstream GitHub issue (TransformerOptimus/SuperAGI#1556) and a public gist describing the issue, with no tagged fixed release or commit confirmed, so upgrade guidance cannot be given as an exact version. Until a fix ships, the most effective control is to add an explicit organization-ownership predicate to the project_id lookup in the agent controller layer - every request must resolve project_id only within the caller's organization scope (or reject it with 403/404) - noting that patched code must be maintained as a local fork and re-applied on every upstream update. Where that is not feasible, restrict the SuperAGI API to trusted networks or place it behind an authenticating reverse proxy that enforces per-organization routing, accepting that this breaks any legitimate cross-org or shared-service integration and does not stop an insider who already holds a valid account. Stronger isolation can be achieved by deploying one SuperAGI instance per organization (separate process, database schema, and credentials), which removes the shared-tenant trust boundary entirely at the cost of duplicate infrastructure and fragmented agent state. As detective measures, alert on /api/agents/* calls whose project_id does not appear in the caller's organization, monitor for agent deletions and schedule edits originating from unexpected accounts, and rotate agent-related API keys if abuse is suspected, since the impact here is integrity and availability tampering rather than data disclosure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-284 (Improper Access Control) expressed as a classic multi-tenant IDOR: SuperAGI's agent controller API treats the client-supplied project_id as trusted and performs no ownership check against the authenticated principal's organization before acting on the referenced project. Because the same endpoints handle agent lifecycle operations - creation, scheduling, schedule edits, schedule stops, and deletion - the missing authorization check is applied uniformly across the controller surface rather than in a single handler, suggesting the project-scoping logic is centralised in a shared query/lookup helper that omits the organization predicate. SuperAGI itself is a Python-based autonomous-agent framework (TransformerOptimus/SuperAGI) whose web layer exposes REST controllers for agent orchestration, so the affected component is the API/controller tier rather than the agent runtime. Neither the CPE dictionary (cpe:2.3:a:n/a:n/a) nor the EUVD affected-version list is populated with a resolvable vendor/product identifier, so version scoping must be taken from the description and the upstream issue tracker rather than from CPE matching; this weakens automated detection and asset matching even though the vulnerable code path is clearly version-bound to v0.0.14 and prior.
Know when Superagi gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated low-priv user (PR:L) over the network (AV:N/AC:L); no data read (C:N), but cross-org create/edit gives I:L and delete/stop gives A:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Ra
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated hi
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in
Cross-organization tool metadata read and modification in SuperAGI v0.0.14 allows an authenticated attacker in one tenan
Cross-tenant agent execution manipulation in SuperAGI up to v0.0.14 lets a remote authenticated user in one organization
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, wri
Cross-organization agent hijacking in SuperAGI 0.0.14 and earlier lets any authenticated user on a shared multi-tenant i
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this v
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls
Exploit-DB