CyberRota Analysis
AI-GeneratedAgentGPT v.1.0.0 is vulnerable to incorrect access control due to an externally accessible path that allows unauthorized data access based on caller-selected identifiers without proper ownership or membership validation. This flaw could lead to unauthorized data exposure or manipulation, impacting the confidentiality and integrity of user data. Organizations using this version should prioritize remediation to mitigate potential data breaches and protect sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.