CVE-2026-51902: Security vulnerability
SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{projectid} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a projectid parameter but does not verify that the project belongs to the authenticated user's organization.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated SuperAGI user associated with one organization can exploit it against projects owned by another organization. The issue is exposed through the agent controller endpoint that accepts a project ID.
What information can an attacker obtain?
An attacker can retrieve the complete list of agents belonging to a project in another organization.
How can I determine whether my deployment is affected?
Deployments running SuperAGI v0.0.14 or earlier are identified as affected. Test whether an authenticated user from one organization can request /api/agents/get/project/{project_id} for a project owned by a different organization and receive that project's agent list.