huntr.com
https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc CVE-2024-12048
HIGH
IDOR Vulnerability in transformeroptimus/superagi
Record summary
CVE-2024-12048 has a selected CVSS score of 8.8 (high).
Description
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationPoC
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 20, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
transformeroptimus/superagiBrowse transformeroptimus / transformeroptimus/superagi | CVE List | Through latest | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-12048