CVE-2026-51904
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.
Impact
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create_agent_execution and create_agent_run in superagi/controllers/agent_execution.py accept a caller-supplied agent_id and fail to verify that the referenced agent belongs to the authenticated user's organization. A remote authenticated attacker from one organization can create or start execution records for agents owned by another organization through /agentexecutions/add or /agentexecutions/add_run.
Affected products
| Product | Affected versions |
|---|---|
| SuperAGI | before 0.0.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.