Superagi CVE-2026-6585

The vulnerability requires a valid authenticated user account within the SuperAGI instance (PR:L authentication level). The attacker must know or enumerate a target organisation_id that belongs to a different user or organization. No special configuration or non-default deployment mode is required - the vulnerability exists in the standard update_organisation endpoint logic. The lack of authorization checks on the organisation_id parameter means any authenticated user can target any organisation regardless of their assigned scope or role. User interaction is not required; exploitation is fully automated via direct API requests.

This vulnerability presents moderate real-world risk despite the moderate CVSS score of 5.4. The attack vector is network-accessible (AV:N) with low complexity (AC:L), but critically requires prior authentication (PR:L), which significantly reduces exposure compared to unauthenticated remote exploitation. The CVSS vector assigns only partial integrity (I:L) and availability (I:A:L) impact, excluding confidentiality concerns. However, the combination of publicly available exploit code, vendor non-responsiveness, and authorization bypass nature elevates practical risk - any user with valid account access can abuse this to modify other organizations' data. The exploit proof-of-concept (E:P) classification confirms POC availability. The low-complexity attack and mandatory authentication suggest this is primarily a lateral privilege escalation or cross-tenant data manipulation risk within multi-user SuperAGI deployments. Organizations with restricted user account issuance face lower risk; those with widely-distributed credentials face higher risk.

A malicious user with valid SuperAGI credentials obtains another organization's ID through enumeration or information disclosure. The attacker sends an authenticated HTTP PATCH request to the Organisation Update Endpoint, manipulating the organisation_id parameter to target the victim organization while modifying sensitive fields such as configuration or resource allocations. The endpoint fails to verify authorization, allowing the request to succeed and corrupting the target organization's data or disabling its availability.