---
id: CVE-2026-51903
title: >-
  SuperAGI v0.0.14 contains an improper access control vulnerability in
  get_agent_by_latest_execution in superagi/controllers/agent_execution.py
summary: >-
  SuperAGI v0.0.14 contains an improper access control vulnerability in
  get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A
  remote authenticated attacker from one organization can retrieve latest
  execution and agent…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'
cvssSource: adp
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-03T13:55:55.422468Z'
exploitAvailable: true
published: '2026-10-29'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T13:56:18.142Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-51903'
references:
  - url: 'https://github.com/TransformerOptimus/SuperAGI'
  - url: 'https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae'
tags:
  - cve.org
  - exploit-available
epss: 0.0033
epssPercentile: 0.26274
ingestedAt: '2026-11-01T22:02:41.005Z'
---

## Overview

SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.