CVE-2026-51904

EPSS 0.19%
Veröffentlicht 02.10.2026 00:00:00
Zuletzt bearbeitet 05.10.2026 19:17:22
Erkennungen
Login

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

CNA 0 VulnDex Vulnerability Enrichment 1

Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.19%	0.082

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://gist.github.com/Ro1ME/3f712e2a9f643a08c6c825d25fbfe0e0

https://nvd.nist.gov/vuln/detail/CVE-2026-51904

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2026-51904

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2026-51904

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2026-51904