CVE-2026-51903

SuperAGI v0.0.14 contains an improper access control vulnerability in getagentbylatestexecution in superagi/controllers/agentexecution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through...

CVE-2026-51905: n/a: TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in…

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

SuperAGI security vulnerability

SuperAGI version 0.0.14 contains a security vulnerability. This vulnerability stems from improper access control in the getagentbylatestexecution function within superagi/controllers/agentexecution.py. Remote authenticated attackers can exploit this by providing the victim’s projectid to access...

PT-2026-132777

SuperAGI v0.0.14 contains an improper access control vulnerability in get agent by latest execution in superagi/controllers/agent execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through...

EUVD-2026-113343

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in getagentexecutionconfiguration in superagi/controllers/agentexecutionconfig.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-51914

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots, saveagentastemplate and publishtemplate in superagi/controllers/agenttemplate.py accept caller-supplied agentid or agentexecutionid values and do not verif...

EUVD-2026-91758

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, gettool and updatetool in superagi/controllers/tool.py accept a caller-supplied toolid and fail to verify organization ownership through the associated toolkit. A...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

PT-2026-104371

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete user knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledge id deletes the selected knowledge object without requiring authentication in the...

CVE-2026-51916: Improper Access Control

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

PT-2026-104370

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI version 0.0.14 Description Incorrect Access Control exists in the tool controller. The functions get tool and update tool in superagi/controllers/tool.py accept a caller-supplied tool id but do not verify if the...

CVE-2026-51916

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in deleteuserknowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledgeid deletes the selected knowledge object without requiring authentication in the rout...

CVE-2026-6615

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initia...

CVE-2026-6614

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function getproject/updateproject/getprojectsorganisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be perform...

CVE-2026-6613

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function deleteagent/stopschedule/getscheduledata of the file superagi/controllers/agent.py. The manipulation of the argument agentid leads to authorization bypass. The attack is possible to be carried out...

CVE-2026-6615: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in TransformerOptimus SuperAGI up to 0.0.14. Affected by this issue is the function Upload of the file superagi/controllers/resources.py of the component Multipart Upload Handler. This manipulation of the argument Name causes path traversal. It is possible to initia...

CVE-2026-6614: Authorization Bypass Through User-Controlled Key

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function getproject/updateproject/getprojectsorganisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be perform...