CVE-2026-67548

taOS is a self-hosted AI agent OS. Prior to version 1.0.0-beta.25, tinyagentos taOS registers all system settings routes under a single APIRouter instance created with no admin authorization dependency. Any authenticated user—including non-admin invited users whose isadmin flag is explicitly...