{"id":"CVE-2026-51899","title":"In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule,…","summary":"In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule,…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cwe":["CWE-284"],"published":"2026-10-02","updated":"2026-10-02","sourceUpdated":"2026-10-02T21:16:55.260","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-51899","references":[{"url":"https://gist.github.com/Ro1ME/c1e18e9c64c324db0bccfaa547eb2d05","label":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1556","label":"cve@mitre.org"},{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1556","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-02T20:22:41.562925Z"},"ingestedAt":"2026-10-02T16:22:59.531Z","epss":0.00191,"epssPercentile":0.08679,"slug":"CVE-2026-51899","body":"## Overview\n\nIn SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":36,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":215131,"id":"CVE-2026-51899","ts":1790980479846,"field":"exploit_available","old":"false","new":"true"},{"seq":215130,"id":"CVE-2026-51899","ts":1790980479846,"field":"cvss","old":null,"new":"4.3"},{"seq":215129,"id":"CVE-2026-51899","ts":1790980479846,"field":"severity","old":"none","new":"medium"}]}