CVE-2026-51903 Details
Description
SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.
A vulnerability in SuperAGI version 0.0.14 has been identified, specifically within the 'get_agent_by_latest_execution' function of 'superagi/controllers/agent_execution.py'. This vulnerability allows remote authenticated attackers from one organization to access the latest execution and agent metadata of projects belonging to another organization. The exploitation is carried out by sending a request to '/agentexecutions/get/latest/agent/project/{project_id}' with a victim's project ID, thereby bypassing access controls and facilitating unauthorized data retrieval.
Users are advised to update to the latest version of SuperAGI, where this vulnerability has been addressed by implementing proper permission checks to prevent unauthorized data access between organizations.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae | CISA-ADP | ExploitTechnical Description |
| https://gist.github.com/Ro1ME/d5e2ff57f9ed891bac0d401c0a7e9aae | [email protected] | ExploitTechnical Description |
| https://github.com/TransformerOptimus/SuperAGI | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| SuperAGI | v0.0.14 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | [email protected] |