CVE-2026-51914

Published: Oct 2, 2026Modified: Oct 5, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://gist.github.com/Ro1ME/bb6fefd4b943400c92c08e0f0644a986

Source: cve@mitre.org

https://gist.github.com/Ro1ME/bb6fefd4b943400c92c08e0f0644a986

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.