CVE-2024-12048: IDOR Vulnerability in transformeroptimus/superagi

Published Mar 20, 2025

Updated

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{projectid}, /get/scheduledata/{agentid}, /delete/{agentid}, /get/organisation/{organisationid}, and /get/user/{userid}.

Affected Software

2 affected components

transformeroptimus superagi

superagi SuperAGI=0.0.14

Event History

Mar 20, 2025

CVE Published

via MITRE·10:11 AM

Data Sourced

via MITRE·10:11 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-12048?

CVE-2024-12048 is classified as a critical severity vulnerability due to its potential impact on user data security.

How do I fix CVE-2024-12048?

To fix CVE-2024-12048, ensure that proper authorization checks are implemented for all affected API endpoints.

What can attackers do with CVE-2024-12048?

Attackers can exploit CVE-2024-12048 to view, edit, and delete information belonging to other users without authorization.

Which software versions are affected by CVE-2024-12048?

CVE-2024-12048 affects the TransformerOptimus SuperAGI version v0.0.14.

How can I determine if my application is vulnerable to CVE-2024-12048?

You can determine if your application is vulnerable to CVE-2024-12048 by reviewing the API authorization checks implemented within the application.