CVE-2026-6584

Summary

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
TransformerOptimusSuperAGI0.0.1affected
TransformerOptimusSuperAGI0.0.2affected
TransformerOptimusSuperAGI0.0.3affected
TransformerOptimusSuperAGI0.0.4affected
TransformerOptimusSuperAGI0.0.5affected
TransformerOptimusSuperAGI0.0.6affected
TransformerOptimusSuperAGI0.0.7affected
TransformerOptimusSuperAGI0.0.8affected
TransformerOptimusSuperAGI0.0.9affected
TransformerOptimusSuperAGI0.0.10affected
TransformerOptimusSuperAGI0.0.11affected
TransformerOptimusSuperAGI0.0.12affected
TransformerOptimusSuperAGI0.0.13affected
TransformerOptimusSuperAGI0.0.14affected

Weaknesses

  • CWE-639: Authorization Bypass
  • CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References