EUVD-2026-23721
GHSA-pw7f-f7wc-gxxw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to modify user accounts by manipulating the user_id parameter in the User Update Endpoint (superagi/controllers/user.py), enabling unauthorized data modification and availability impact. Publicly available exploit code exists; the vendor has not responded to disclosure efforts.
Technical ContextAI
The vulnerability exists in the user update functionality of SuperAGI's REST API endpoint. The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), indicating insufficient validation of the user_id parameter during authorization checks. When an authenticated user submits an update request, the application fails to properly verify that the requester has authority to modify the target user account. An attacker can supply an arbitrary user_id value to modify other users' accounts rather than their own. This is a classic horizontal privilege escalation flaw common in multi-tenant or multi-user web applications where object-level authorization is not correctly enforced.
RemediationAI
Upgrade TransformerOptimus SuperAGI to a version newer than 0.0.14 immediately. If an immediate upgrade is not feasible, implement the following compensating controls: (1) Add server-side authorization checks in the update_user function to verify that the authenticated user's ID matches the user_id parameter being updated, rejecting requests where the IDs do not match with a 403 Forbidden response - this prevents horizontal privilege escalation. (2) Implement request logging and alerting on update_user calls where the requester ID differs from the target user_id to detect ongoing exploitation attempts. (3) Restrict API access to the User Update Endpoint by IP allowlist or API gateway rules, limiting access to trusted administrative networks if the endpoint is not required for general users. Note that controls (2) and (3) are detective and preventive respectively but do not fix the underlying flaw; they reduce risk only until patching is complete. Verify patch availability with the vendor at the SuperAGI project repository.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Ra
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated hi
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, wri
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this v
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attac
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate th
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today