EUVD-2026-90415
GHSA-m2qp-332m-87w4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate or reach exposed agentRouter path
-
DeliveryEnumerate another tenant's object/tenant ID
-
ExploitSubmit request with victim identifier
-
ExecutionServer skips ownership check
-
ImpactRead or alter cross-tenant data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires reaching the externally accessible agentRouter tRPC path in next/src/server/api/routers/agentRouter.ts and supplying an attacker-chosen object or tenant identifier; the flaw triggers because that identifier flows into a data-access operation with no owner/tenant/workspace/membership check. The description's wording ('caller-selected ... identifier') indicates the attacker must be a caller able to submit such a request, so a reachable (likely authenticated) session is the practical prerequisite - this contradicts the input's PR:N. Limiting factors: only data belonging to identifiers the attacker can guess or enumerate is exposed, impact is confined to multi-tenant/multi-user deployments of AgentGPT v1.0.0, and no availability/service-disruption vector is evident despite the input's A:H claim. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H, base 9.8) paints a critical, remotely and trivially exploitable flaw, but the other signals strongly contradict a 'drop everything' priority. EPSS is only 0.19% (8th percentile), there is no CISA KEV listing, and no SSVC decision data was supplied, so there is no evidence of active or automatable exploitation. This is a classic high-CVSS-but-low-real-world-risk profile driven by the CWE-284 broken/incorrect access control pattern, amplified by a niche open-source product footprint. Two input signals are also questionable and should be verified: (1) the A:H (availability) impact is dubious for an IDOR-style access-control read/write flaw - such bugs typically affect confidentiality and integrity, not availability, so the 9.8 base is likely inflated; and (2) PR:N (unauthenticated) conflicts with the description's phrase 'caller-selected object or tenant identifier,' which implies an authenticated caller abusing missing ownership/tenant binding (an IDOR), i.e. PR:L is more plausible - verify against the referenced gist and source. Net assessment: a genuine multi-tenant/object-level authorization defect worth patching, but current telemetry indicates low likelihood of widespread opportunistic exploitation. |
| Exploit ScenarioDerived | An attacker with a valid (or trivially obtained) session on a self-hosted AgentGPT instance sends a request to the agentRouter endpoint supplying another tenant's or user's object/tenant identifier. Because the server performs the data-access operation without checking owner, workspace, or membership binding, the attacker reads or manipulates data belonging to other tenants. A gist write-up referenced in the advisory may contain proof-of-concept details, but no weaponized exploit is confirmed in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 02, 2026
Broken access control in AgentGPT 1.0.0 allows authenticated remote callers to read or modify resources belonging to other tenants by supplying an arbitrary object or tenant identifier to the externally reachable agentRouter tRPC endpoint, which performs data access without owner, tenant, workspace, or membership checks. The independent assessment scores this as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, reflecting high confidentiality and integrity impact but no availability impact and a required authenticated session, contradicting the original PR:N/A:H vector. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low (0.19%), so exploitation is most plausible in multi-tenant or multi-user deployments where identifiers can be guessed or enumerated.
RemediationAI
No vendor-released patch was identified at time of analysis, and the advisory references (https://gist.github.com/Ro1ME/62547f81c244f273b66755dad63a8673 and https://nvd.nist.gov/vuln/detail/CVE-2026-51867) do not specify a fixed AgentGPT version. Until a patched release is available, restrict access to the agentRouter tRPC endpoint so only trusted, authenticated users can reach it, and add server-side authorization that binds every data-access call to the caller's owner, tenant, workspace, or membership before returning or modifying records; this may require code changes in next/src/server/api/routers/agentRouter.ts and carries the trade-off of development effort and potential breakage of legitimate cross-tenant workflows. Where the endpoint cannot be patched immediately, disable or remove the vulnerable procedure from the externally reachable surface, or place the AgentGPT deployment behind a network or reverse-proxy rule that limits the tRPC path to known clients, recognizing that this can disrupt intended API consumers. Monitor the NVD/EUVD entry and the referenced gist for an updated fixed version, and treat multi-tenant deployments as higher risk because exposed data is limited only by the attacker's ability to guess or enumerate identifiers.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AgentGPT is a Next.js application that exposes server-side procedures through tRPC routers located under next/src/server/api/routers/, and agentRouter.ts is one such router. The vulnerability is an instance of CWE-284 (Improper Access Control): an externally reachable tRPC procedure accepts a caller-selected object or tenant identifier and passes it directly into a data-access operation without first verifying that the caller owns, belongs to, or is a member of the referenced object, tenant, or workspace. This is a broken object-level authorization (BOLA/IDOR) pattern rather than a memory-safety or injection flaw, and its practical impact depends on multi-tenant or multi-user deployment models where identifiers can be guessed or enumerated. The independent assessment rates the flaw CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating that a reachable session, likely authenticated, is the realistic prerequisite, and that no availability impact is evident; CPE mapping is absent (cpe:2.3:a:n/a:n/a), so coverage should be scoped by product name and version rather than by CPE.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable IDOR with low attacker effort; 'caller-selected' identifier implies an authenticated caller (PR:L); broken authorization affects cross-tenant data (C:H/I:H) but not availability (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Executive ViewAI
AgentGPT 1.0.0 contains a critical broken access control vulnerability that could allow authenticated remote callers to read or modify data belonging to other tenants or workspaces. This creates significant confidentiality and integrity risk for organizations running multi-tenant or multi-user AgentGPT deployments, potentially exposing sensitive customer data and undermining tenant isolation. No vendor-released patch identified at time of analysis, so leadership should prioritize interim containment and monitoring to protect customer trust and meet compliance obligations.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting external access to agentRouter, enforcing tenant/owner/workspace/membership authorization checks at the gateway or application layer, applying least privilege, monitoring for cross-tenant access, and temporarily disabling multi-tenant functionality if isolation cannot be assured.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB