EUVD-2026-48330
GHSA-wwx9-477p-w7rm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable but requires authentication (PR:L) and a separately-obtained foreign run_id (AC:H); no confidentiality loss, only bounded integrity and availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run_id in the request body without ownership verification. The AgentCRUD.create_task and validate_task_count functions look up the target AgentRun using the client-supplied run_id without confirming the run belongs to the requesting user, enabling an attacker who obtains a valid run_id to corrupt task history, exhaust the per-run loop budget, and drive LLM costs against the victim's run.
AnalysisAI
Authorization bypass in AgentGPT through 1.0.0 allows authenticated attackers to hijack other users' agent runs by supplying an arbitrary run_id in the request body, exploiting missing ownership validation in the AgentCRUD.create_task and validate_task_count functions. Successful exploitation enables task history corruption, exhaustion of per-run LLM loop budgets, and financial damage by driving API costs against the victim's account. A public proof-of-concept exists per VulnCheck reporting; no CISA KEV listing is present, and the low CVSS 4.0 score of 2.3 reflects the high attack complexity and constrained integrity/availability impact.
Technical ContextAI
AgentGPT (CPE: cpe:2.3:a:reworkd:agentgpt:*:*:*:*:*:*:*:*) is an open-source autonomous AI agent platform built on top of LLM APIs. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), an Insecure Direct Object Reference (IDOR) subclass in which the application accepts a resource identifier from the client (here, run_id) and performs sensitive operations against the corresponding backend object without verifying the requesting user owns it. Specifically, the AgentCRUD.create_task function and the validate_task_count function both resolve the target AgentRun record directly from the client-supplied run_id value without any ownership check, allowing a logged-in user to reference and modify agent runs belonging to other accounts. The affected scope is version 1.0.0 and all prior releases.
RemediationAI
No vendor-released patch has been identified at time of analysis - the fix version is not independently confirmed. The root cause requires server-side ownership enforcement: both AgentCRUD.create_task and validate_task_count must verify that the requesting authenticated user is the owner of the AgentRun identified by the supplied run_id before proceeding. As a compensating control, operators running self-hosted AgentGPT instances should restrict API access to trusted users only, preventing untrusted authenticated accounts from reaching the task creation endpoint. Additionally, run_id values should ideally be generated as high-entropy UUIDs rather than sequential identifiers to reduce the feasibility of run_id enumeration. Rate-limiting the task creation endpoint reduces the window for budget exhaustion attacks. Disabling multi-user access on self-hosted instances eliminates the cross-user attack surface entirely, though at the cost of collaborative functionality. Monitor the VulnCheck advisory (https://www.vulncheck.com/advisories/agentgpt-authorization-bypass-via-agent-task-creation) for patch release announcements.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today