{"id":"CVE-2026-51905","title":"TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py","summary":"TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"adp","ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-30T16:51:02.781918Z"},"exploitAvailable":true,"published":"2026-10-29","updated":"2026-10-30","sourceUpdated":"2026-10-30T17:13:57.738Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-51905","references":[{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1559"},{"url":"https://gist.github.com/Ro1ME/f803bb0db782428b212492c8157290db"}],"tags":["cve.org","exploit-available"],"epss":0.00381,"epssPercentile":0.32292,"ingestedAt":"2026-11-05T16:24:31.139Z","slug":"CVE-2026-51905","body":"## Overview\n\nTransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":60,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}