TransformerOptimus SuperAGI agent.py get_schedule_data authorization_CVE-2026-6613

5.3 / 10

MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Description

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Basic Information

ID CVE-2026-6613

Source VulDB

Published Apr 20, 2026 at 06:30

Affected Product

Vendor TransformerOptimus

Product SuperAGI

Version 0.0.1

Affected Versions TransformerOptimus SuperAGI 0.0.1
TransformerOptimus SuperAGI 0.0.2
TransformerOptimus SuperAGI 0.0.3
TransformerOptimus SuperAGI 0.0.4
TransformerOptimus SuperAGI 0.0.5
TransformerOptimus SuperAGI 0.0.6
TransformerOptimus SuperAGI 0.0.7
TransformerOptimus SuperAGI 0.0.8
TransformerOptimus SuperAGI 0.0.9
TransformerOptimus SuperAGI 0.0.10
TransformerOptimus SuperAGI 0.0.11
TransformerOptimus SuperAGI 0.0.12
TransformerOptimus SuperAGI 0.0.13
TransformerOptimus SuperAGI 0.0.14

CWE Classification

CWE-639 CWE-285

References

{
    "lastseen": "",
    "description": "A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.",
    "published": "2026-04-20T06:30:14.889Z",
    "modified": "2026-04-20T06:30:14.889Z",
    "type": "cve",
    "title": "TransformerOptimus SuperAGI agent.py get_schedule_data authorization",
    "source": "VulDB",
    "references": "https://vuldb.com/vuln/358248\nhttps://vuldb.com/vuln/358248/cti\nhttps://vuldb.com/submit/791081\nhttps://gist.github.com/YLChen-007/1d87985b274ce22c4294726d7758df8e",
    "id": "CVE-2026-6613",
    "bulletinFamily": "",
    "cwe": [
        "CWE-639",
        "CWE-285"
    ],
    "cvelist": null,
    "sourceData": "TransformerOptimus SuperAGI 0.0.1\nTransformerOptimus SuperAGI 0.0.2\nTransformerOptimus SuperAGI 0.0.3\nTransformerOptimus SuperAGI 0.0.4\nTransformerOptimus SuperAGI 0.0.5\nTransformerOptimus SuperAGI 0.0.6\nTransformerOptimus SuperAGI 0.0.7\nTransformerOptimus SuperAGI 0.0.8\nTransformerOptimus SuperAGI 0.0.9\nTransformerOptimus SuperAGI 0.0.10\nTransformerOptimus SuperAGI 0.0.11\nTransformerOptimus SuperAGI 0.0.12\nTransformerOptimus SuperAGI 0.0.13\nTransformerOptimus SuperAGI 0.0.14",
    "sourceHref": "",
    "cvss": {
        "score": 5.3,
        "severity": "MEDIUM",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "SuperAGI",
    "version": "0.0.1",
    "vendor": "TransformerOptimus",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}