CVE-2026-6614: TransformerOptimus SuperAGI project.py get_projects_organisation authorization
A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function getproject/updateproject/getprojectsorganisation of the file superagi/controllers/project.py. The manipulation results in authorization bypass. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6614?
CVE-2026-6614 is classified as a medium severity vulnerability due to its impact on user authorization.
How do I fix CVE-2026-6614?
To fix CVE-2026-6614, upgrade to a version of TransformerOptimus SuperAGI that is greater than 0.0.14.
What parts of the TransformerOptimus SuperAGI are affected by CVE-2026-6614?
CVE-2026-6614 affects the get_project, update_project, and get_projects_organisation functions in the superagi/controllers/project file.
What types of attacks can exploit CVE-2026-6614?
CVE-2026-6614 can potentially allow unauthorized users to access or modify project information.
Who is responsible for addressing CVE-2026-6614?
The maintainers of the TransformerOptimus SuperAGI project are responsible for addressing and patching CVE-2026-6614.