CyberRota Analysis
AI-GeneratedTransformerOptimus SuperAGI v0.0.14 has an access control vulnerability in the delete_user_knowledge function, allowing unauthenticated users to delete knowledge objects via the POST /knowledges/delete/{knowledge_id} endpoint without verifying ownership. This could lead to unauthorized data deletion, potentially compromising the integrity of knowledge management within the application. Organizations using this version should prioritize patching to mitigate the risk of data loss and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without requiring authentication in the route and without verifying organization ownership of the supplied knowledge_id.