CyberRota Analysis
AI-GeneratedTransformerOptimus SuperAGI v0.0.14 is susceptible to incorrect access control in the agent template controller, allowing unauthorized users to manipulate agent templates by supplying arbitrary agent IDs or execution IDs. This vulnerability could lead to unauthorized access to sensitive agent data and operations, potentially compromising organizational integrity. Organizations utilizing this version of SuperAGI should prioritize remediation to safeguard against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.