CVE-2026-30950

HIGH

AutoGPT has Authenticated Session Hijacking via IDOR

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-30950. PoCs published by ZeroPathAI.

AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2026-30950, an authenticated session hijacking vulnerability in AutoGPT due to missing authorization checks in the PATCH /api/chat/sessions/{session_id}/assign-user endpoint. The PoC demonstrates how an attacker can reassign any chat session to themselves, locking out the original owner.

Description

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the session_id of another user's session, they can take it over, reading any messages in it and locking the legitimate user out. The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies session ownership: the service layer invokes the session lookup with user_id=None, which the data access layer interprets as a privileged/system call that bypasses the ownership filter, allowing any authenticated user to reassign an arbitrary session to themselves. This issue has been patched in version 0.6.51.

Exploits (1)

github WORKING POC
by ZeroPathAI · pythonpoc
https://github.com/ZeroPathAI/autogpt-CVE-2026-30950-poc

This repository contains a functional exploit PoC for CVE-2026-30950, an authenticated session hijacking vulnerability in AutoGPT due to missing authorization checks in the PATCH /api/chat/sessions/{session_id}/assign-user endpoint. The PoC demonstrates how an attacker can reassign any chat session to themselves, locking out the original owner.

Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: AutoGPT autogpt-platform-backend >= 0.6.36, < 0.6.51
Auth required
Prerequisites: Authenticated attacker account · Valid session_id of the victim
devstral-2 · analyzed May 21, 2026 Full analysis →

Scores

CVSS v3 7.1
EPSS 0.0002
EPSS Percentile 3.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (1)
Significant-Gravitas/AutoGPT >= 0.6.36, < 0.6.51
Published May 18, 2026
Tracked Since May 19, 2026