CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

PT-2026-104370

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI version 0.0.14 Description Incorrect Access Control exists in the tool controller. The functions get tool and update tool in superagi/controllers/tool.py accept a caller-supplied tool id but do not verify if the...

EUVD-2026-91758

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51916: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

PT-2026-104371

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete user knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledge id deletes the selected knowledge object without requiring authentication in the...

SuperAGI 安全漏洞

SuperAGI is an open-source infrastructure application developed by SuperAGI. It is used to build components, tools, frameworks, and models to achieve open-source AGI. Versions of SuperAGI 0.0.14 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling of the...

CVE-2026-6615: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initia...

CVE-2026-6613: Authorization Bypass Through User-Controlled Key

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function deleteagent/stopschedule/getscheduledata of the file superagi/controllers/agent.py. The manipulation of the argument agentid leads to authorization bypass. The attack is possible to be carried out...

CVE-2026-6584: Authorization Bypass Through User-Controlled Key

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function updateuser of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument userid results in authorization bypass. The attack may be...

CVE-2026-6614: Authorization Bypass Through User-Controlled Key

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function getproject/updateproject/getprojectsorganisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be perform...