EUVD-2026-91759
GHSA-8q94-2856-4jcf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege SuperAGI account
-
ExploitSupply victim org's agent_id or agent_execution_id
-
ExecutionInvoke save_agent_as_template / publish_template
-
ImpactExfiltrate or republish cross-tenant agent configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated SuperAGI account (any low-privilege org user) and a multi-tenant deployment of v0.0.14 where multiple organizations' agents coexist; the attacker passes another org's agent_id or agent_execution_id to the save_agent_as_template or publish_template endpoints, which perform no organization-ownership check in the affected snapshots - no special feature toggle or non-default configuration is needed. Exploitation is limited by the need for authentication (not anonymous) and by the fact that single-tenant/single-org installations have no other organization to cross into, bounding real-world impact to shared/hosted deployments. |
| Impact | The input CVSS of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) frames this as a high-severity, network-exploitable, low-complexity flaw needing only low privileges, but the corroborating signals argue against treating it as an urgent, widespread priority. EPSS is only 0.21% (10th percentile), there is no CISA KEV listing (not confirmed actively exploited), and no SSVC decision data was supplied. A public gist reference (Ro1ME) exists and may contain proof-of-concept or write-up details, but POC status is not explicitly flagged in the input, so exploit-code availability is unconfirmed. The NVD impact of C:H/I:H/A:H appears overstated for an authorization/IDOR flaw whose core effect is cross-tenant exposure and unauthorized templating of other organizations' agents - real availability impact is doubtful (see assessed vector). Net: a genuine multi-tenant access-control bug worth fixing, but given the early-stage, niche product (v0.0.14), low EPSS, and absence of KEV, this reads as a high-CVSS-but-moderate-real-risk issue rather than a mass-exploitation emergency. |
| Exploit ScenarioDerived | An attacker holds or registers a low-privilege account in one organization on a shared SuperAGI v0.0.14 instance, then calls save_agent_as_template or publish_template while supplying an agent_id or agent_execution_id belonging to a different organization. Because the controller never checks org ownership, the attacker captures or republishes another tenant's proprietary agent configuration. A public gist reference exists that may describe the technique, but confirmed exploit code is not established from the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 05, 2026
Incorrect access control in TransformerOptimus SuperAGI v0.0.14 lets an authenticated, low-privilege organization user in a multi-tenant deployment supply another organization's agent_id or agent_execution_id to the save_agent_as_template and publish_template endpoints, which perform no ownership check on the referenced agent or execution - enabling cross-organization disclosure of agent data and unauthorized template creation. Exploitation requires a valid authenticated account (PR:L) and a deployment where multiple organizations' agents coexist, so single-tenant installations are essentially unaffected; no public exploit identified at time of analysis, EPSS is 0.21% (10th percentile), and there is no CISA KEV listing. Our independent re-assessment scores this 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) rather than the submitted 8.8, reflecting confirmed confidentiality exposure with more limited integrity impact and no availability impact.
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis, so remediation must start with compensating controls. The most direct fix is to harden the two endpoints in superagi/controllers/agent_template.py by rejecting any agent_id or agent_execution_id that is not owned by the caller's organization - resolve the object server-side from the authenticated session's org scope and return 403/404 on mismatch, rather than trusting the request body; if you maintain a fork or can apply a patch, this authorization check (and the same pattern for publish_template) is the core change and can typically be implemented without database migrations, though it will break any legitimate cross-team template reuse workflows that relied on unrestricted IDs. Where source changes are impractical, restrict access to the agent-template API (block or front the routes that trigger save_agent_as_template and publish_template at the reverse proxy / API gateway, allow-listing only trusted admin roles) - this removes the attack surface but disables template save/publish for normal users as a side effect. Additional containment for multi-tenant operators: run SuperAGI in strictly single-org deployments or isolate tenants on separate instances/databases, enforce least privilege so ordinary users hold only the roles they need, and log/alert on template-controller calls whose body IDs are absent from the caller's org (a high-fidelity detection signal for this IDOR pattern). Monitor the NVD record (https://nvd.nist.gov/vuln/detail/CVE-2026-51914), the ENISA EUVD entry (EUVD-2026-91759) and the upstream TransformerOptimus SuperAGI repository for a released fixed version, and re-test both endpoints after any upgrade.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an instance of CWE-284 (Improper Access Control) - specifically a broken object-level authorization / IDOR pattern in superagi/controllers/agent_template.py. SuperAGI is a multi-tenant agent-development platform backed by a relational database (MySQL/PostgreSQL) in which agents, agent executions and organizations are stored as separate records; the agent template controller is intended to let a user save one of their own agents as a reusable template and publish it. In the affected v0.0.14 source snapshot, the save_agent_as_template and publish_template handlers accept caller-supplied agent_id / agent_execution_id values directly from the request and never join or filter against the authenticated user's org, so the authorization decision is effectively delegated to the client. Because the requests are ordinary authenticated HTTP calls to the web API, no special feature flag, non-default configuration or elevated role is required - the only prerequisites are a valid session and the existence of at least one other organization's agent ID in the same instance. The supplied CPE record (cpe:2.3:a:n/a:n/a) carries no useful vendor/product/version binding, so version attribution rests on the source-snapshot statement for v0.0.14 and the ENISA EUVD entry, which likewise lists no parsed version range.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated API call (PR:L) over the network at low complexity; primary impact is cross-tenant disclosure (C:H) with limited integrity from unauthorized templating (I:L) and no availability impact (A:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.
Executive ViewAI
SuperAGI v0.0.14 contains an access-control weakness that lets any authenticated user in a multi-tenant deployment pull another organization's agent configurations and publish them as templates. The exposure is confined to shared, multi-tenant installations, where it undermines the tenant isolation customers assume they have and could expose proprietary agent logic or sensitive prompt and data configurations. Single-tenant deployments are effectively unaffected, so leadership concern should center on whether any shared SuperAGI instance handles third-party or regulated data.
No vendor-released patch identified at time of analysis. Interim mitigations: migrate multi-tenant SuperAGI v0.0.14 deployments to isolated single-tenant instances, restrict or proxy the save_agent_as_template and publish_template endpoints to trusted administrative accounts, enforce server-side ownership checks binding agent_id and agent_execution_id to the requesting organization, disable self-service template publishing, audit existing templates for cross-organization content, and rotate secrets exposed in affected agent configurations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB