CVE-2026-6614

Summary

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_projects_organisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Affected Software

VendorProductVersion RangeStatus
TransformerOptimusSuperAGI0.0.1affected
TransformerOptimusSuperAGI0.0.2affected
TransformerOptimusSuperAGI0.0.3affected
TransformerOptimusSuperAGI0.0.4affected
TransformerOptimusSuperAGI0.0.5affected
TransformerOptimusSuperAGI0.0.6affected
TransformerOptimusSuperAGI0.0.7affected
TransformerOptimusSuperAGI0.0.8affected
TransformerOptimusSuperAGI0.0.9affected
TransformerOptimusSuperAGI0.0.10affected
TransformerOptimusSuperAGI0.0.11affected
TransformerOptimusSuperAGI0.0.12affected
TransformerOptimusSuperAGI0.0.13affected
TransformerOptimusSuperAGI0.0.14affected

Weaknesses

  • CWE-639: Authorization Bypass
  • CWE-285: Improper Authorization

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References