CVE-2024-12048
IDOR Vulnerability in transformeroptimus/superagi
- State
- Published
- Severity
- 8.8 High
- Published
- Mar 20, 2025
- Updated
- Mar 20, 2025
- Reserved
- Dec 2, 2024
Description
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 8.8 High | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | @huntr_ai |
Weaknesses
- CWE-304 Missing Critical Step in Authentication
Affected Products
| Product | Versions |
|---|---|
transformeroptimus/superagitransformeroptimus |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.