Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-51915: SuperAGI 0.14 tool controller exposes other orgs' data
CVE-2026-51915 · published 16 days ago
Summary
In version 0.14 of SuperAGI, the functions that retrieve or change tool information do not confirm that the user belongs to the same organization as the tool. This lets a signed‑in user from one company read or edit tool details belonging to a different company. Upgrade to a newer version or apply the vendor's patch and ensure proper access checks are in place.
Original advisory text
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a...
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-284Improper Access Control
Timeline
Published2 Oct 2026
Updated15 Oct 2026
First seen2 Oct 2026
Track software like this
Free during beta