An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc | Exploit Third Party Advisory |
| https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc | Exploit Third Party Advisory |
Configurations
History
18 Jul 2025, 19:58
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-639 | |
| References | () https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc - Exploit, Third Party Advisory | |
| First Time |
Superagi
Superagi superagi |
|
| CPE | cpe:2.3:a:superagi:superagi:0.0.14:*:*:*:*:*:*:* |
20 Mar 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-18 19:58
NVD link : CVE-2024-12048
Mitre link : CVE-2024-12048
JSON object : View
Products Affected
superagi
- superagi
CWE
CWE-639
Authorization Bypass Through User-Controlled Key