CVE-2026-6584: TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization
A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function updateuser of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument userid results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6584?
The severity of CVE-2026-6584 is categorized as critical due to its potential to allow unauthorized users to update user information.
How do I fix CVE-2026-6584?
To fix CVE-2026-6584, upgrade TransformerOptimus SuperAGI to version 0.0.15 or later, which addresses this vulnerability.
What component is affected by CVE-2026-6584?
CVE-2026-6584 affects the User Update Endpoint function update_user in the superagi/controllers/user.py file.
Can CVE-2026-6584 lead to user impersonation?
Yes, CVE-2026-6584 can potentially allow an attacker to impersonate other users by manipulating user update requests.
What versions of TransformerOptimus SuperAGI are impacted by CVE-2026-6584?
Versions of TransformerOptimus SuperAGI up to and including 0.0.14 are impacted by CVE-2026-6584.