EUVD-2026-23791Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
8DescriptionCVE.org
A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated attackers to manipulate the agent_id parameter in delete_agent, stop_schedule, and get_schedule_data endpoints, bypassing access controls to perform unauthorized operations on agents and schedules. The vulnerability is remotely exploitable by any authenticated user and publicly available exploit code exists; however, the vendor has not responded to early disclosure attempts.
Technical ContextAI
The vulnerability exists in the agent.py controller file where three endpoints (delete_agent, stop_schedule, get_schedule_data) fail to properly validate that the requesting user has authorization to perform operations on the specified agent_id. This is a classic broken access control flaw (CWE-639: Authorization Bypass Through User-Controlled Key) where user-supplied input (agent_id) is used to fetch and operate on resources without verifying ownership or role-based permissions. The CVSS 4.0 vector indicates attack surface requires network access (AV:N) and low complexity (AC:L), but crucially requires prior authentication (PR:L), meaning the attacker must already have a valid user account. The manipulation allows an authenticated user to perform privileged actions on agents and schedules belonging to other users.
RemediationAI
No vendor-released patch has been identified at time of analysis, given the vendor's non-response to disclosure. Immediate mitigations include: (1) Restrict access to the SuperAGI application to trusted users only, implementing network-level controls (VPN, IP allowlisting) to limit authentication attack surface; (2) Implement application-level authorization checks by modifying the agent.py controller to verify that the authenticated user making requests to delete_agent, stop_schedule, and get_schedule_data owns or has explicit permissions for the specified agent_id - this requires code review and patching by the organization or community fork; (3) Monitor application logs for suspicious agent_id parameter manipulation across different users' accounts; (4) Evaluate alternative agent management platforms with mature authorization controls if SuperAGI cannot be hardened. Since the vendor is unresponsive, organizations should consider community-driven security patches or forking the repository if the codebase is open-source.
A Path Traversal vulnerability exists in the file upload functionality of transformeroptimus/superagi version 0.0.14. Ra
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. Rated hi
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated high severity
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. Rated medium severi
In version 0.0.14 of transformeroptimus/superagi, the API endpoint `/api/users/get/{id}` returns the user's password in
Remote unauthenticated access to vector database configurations in TransformerOptimus SuperAGI ≤0.0.14 allows attackers
Path traversal in TransformerOptimus SuperAGI versions up to 0.0.14 allows remote unauthenticated attackers to read, wri
SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. Rated high severity (CVSS 7.5), this v
TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to bypass authorization controls
Server-side request forgery (SSRF) in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attac
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated remote attackers to access
Authorization bypass in TransformerOptimus SuperAGI up to version 0.0.14 allows authenticated users to modify arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today