CVE-2026-6613

TransformerOptimus SuperAGI agent.py get_schedule_data authorization

State: Published
Severity: 5.3 Medium
Published: Apr 20, 2026
Updated: Apr 20, 2026
Reserved: Apr 19, 2026

Description

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file superagi/controllers/agent.py. The manipulation of the argument agent_id leads to authorization bypass. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-639 Authorization Bypass
CWE-285 Improper Authorization

Affected Products

Product	Versions
SuperAGITransformerOptimus	0.0.1Affected 0.0.2Affected 0.0.3Affected 0.0.4Affected 0.0.5Affected 0.0.6Affected 0.0.7Affected 0.0.8Affected 0.0.9Affected 0.0.10Affected 0.0.11Affected 0.0.12Affected 0.0.13Affected 0.0.14Affected

References

VDB-358248 | TransformerOptimus SuperAGI agent.py get_schedule_data authorizationvdb-entrytechnical-description
VDB-358248 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #791081 | SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639)third-party-advisory
https://gist.github.com/YLChen-007/1d87985b274ce22c4294726d7758df8eexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.