SuperAGI vulnerabilities

TransformerOptimus SuperAGI v0.0.14 is vulnerable to incorrect access control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve the latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/{knowledge_id} deletes the selected knowledge object without requiring authentication in the route and without verifying organization ownership of the supplied knowledge_id.

TransformerOptimus SuperAGI v0.0.14 is vulnerable to incorrect access control in the agent template controller. In affected source snapshots, save_agent_as_template and publish_template in superagi/controllers/agent_template.py accept caller-supplied agent_id or agent_execution_id values and do not verify that the referenced agent or execution belongs to the authenticated user's organization.

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allows authenticated users from one organization to schedule existing agents belonging to a different organization without proper authorization checks. The endpoint accepts an agent_id parameter but does not verify that the agent belongs to the authenticated user's organization.

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14 affecting the extract_with_bs4/extract_with_3k/extract_with_lxml functions in superagi/helper/webpage_extractor.py of the WebScraperTool component. Manipulation leads to server-side request forgery. The exploit has been publicly disclosed and can be launched remotely.

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14 affecting the get_project/update_project/get_projects_organisation functions in superagi/controllers/project.py. Manipulation results in authorization bypass. The attack can be performed remotely and the exploit has been released publicly.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14 affecting the delete_agent/stop_schedule/get_schedule_data functions in superagi/controllers/agent.py. Manipulation of the agent_id argument leads to authorization bypass. The attack can be carried out remotely and the exploit is publicly available.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the get_agent_execution/update_agent_execution functions in superagi/controllers/agent_execution.py (Agent Execution Endpoint component). Manipulation of the agent_execution_id argument can lead to authorization bypass. The attack can be performed remotely, and the exploit has been publicly disclosed.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14 affecting the get_budget/update_budget functions in superagi/controllers/budget.py of the Budget Endpoint component. The manipulation leads to authorization bypass and can be exploited remotely. The exploit is publicly available and may be used; the vendor did not respond to the disclosure.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the update_organisation function in superagi/controllers/organisation.py (Organisation Update Endpoint). Manipulation of the organisation_id argument causes authorization bypass. The exploit has been publicly disclosed and may be used remotely; the vendor did not respond.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the update_user function in superagi/controllers/user.py (User Update Endpoint). Manipulation of the user_id argument results in authorization bypass. The exploit has been made public and could be used remotely; the vendor did not respond.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the delete_api_key/edit_api_key functions in superagi/controllers/api_key.py (API Key Management Endpoint). Manipulation leads to authorization bypass. The exploit has been disclosed to the public and may be used remotely; the vendor did not respond.