Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.4

TinyAGI Message API can be called without permission

CVE-2026-19010 · published 3 months ago
Summary

TinyAGI version 0.0.20 lets anyone send messages through its Message API without checking that the requester is authorized. This can be done from anywhere on the internet, potentially allowing unwanted actions or data access. Update to a patched version or apply a fix that adds proper authorization checks to the processMessage function.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
– tinyagi 0.0.20
Original advisory text
TinyAGI Message API Endpoint index.ts processMessage authorization
A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component Message API Endpoint. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
8.4 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-863Incorrect Authorization
Timeline
Published6 Aug 2026
Updated4 Nov 2026
First seen6 Aug 2026
Sources
CVE-2026-19010 · NVD
CVE-2026-19010 · MITRE
CVE-2026-19010 · OSV
Track software like this
Free during beta