Superagi CVE-2026-6614

Exploitation requires an authenticated user account with valid credentials to the SuperAGI application - this is the critical limiting factor. Default SuperAGI installations with open user registration or shared test credentials are at highest risk. Once authenticated, the vulnerability can be exploited without additional user interaction or special configuration. The three affected endpoints (get_project, update_project, get_projects_organisation) do not validate that the authenticated user owns or has access to the requested project resource, so any authenticated user can enumerate and modify arbitrary projects by varying project identifiers. Non-default configurations such as network isolation, WAF rules, or reverse proxy authentication can reduce but do not eliminate the risk. Exploitation is limited to the project management subsystem; system-level administrative functions are not affected by this vulnerability.

This is a moderate-severity authorization bypass with several confirming signals of real-world risk. The CVSS 5.3 score reflects network-accessible attack surface (AV:N), low attack complexity (AC:L), and requirement for prior authentication (PR:L), which correctly models the threat model. The CVSS vector indicates limited impact across confidentiality, integrity, and availability (VC:L, VI:L, VA:L) - consistent with horizontal privilege escalation within the same user role tier rather than full system compromise. Critically, the exploit has been publicly disclosed (POC status confirmed), and the vendor's non-response to early notification suggests no patch is forthcoming, elevating the practical risk for organizations using SuperAGI in production. However, the attack requires valid credentials (PR:L), which narrows the threat to insider threats, compromised accounts, or environments where user registration is open. The authorization bypass scope is confined to project-level operations rather than system-wide, limiting damage to the affected project's data rather than the entire application.

An attacker with valid credentials (such as a low-privileged user or insider) authenticates to the SuperAGI application. Using the publicly available exploit code from GitHub, the attacker crafts requests to the get_project endpoint with project IDs belonging to other users or teams, successfully retrieving sensitive project configuration and data without authorization checks. The attacker then uses the update_project endpoint to modify another user's project settings, such as changing AI model configurations or stealing intellectual property embedded in the project definition.