CVE-2026-6584

MEDIUM

TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization

Title source: cna

Description

A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-358219 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization

https://vuldb.com/vuln/358219

Signature, Permissions Required signature permissions-required

VDB-358219 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/358219/cti

Third Party Advisory third-party-advisory

Submit #791075 | SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639)

https://vuldb.com/submit/791075

Exploit exploit

https://gist.github.com/YLChen-007/79b967ece52d424558f279156dd53324

Scores

CVSS v3 5.4

EPSS 0.0030

EPSS Percentile 21.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-285 CWE-639

Status published

Products (14)

TransformerOptimus/SuperAGI 0.0.1

TransformerOptimus/SuperAGI 0.0.10

TransformerOptimus/SuperAGI 0.0.11

TransformerOptimus/SuperAGI 0.0.12

TransformerOptimus/SuperAGI 0.0.13

TransformerOptimus/SuperAGI 0.0.14

TransformerOptimus/SuperAGI 0.0.2

TransformerOptimus/SuperAGI 0.0.3

TransformerOptimus/SuperAGI 0.0.4

TransformerOptimus/SuperAGI 0.0.5

... and 4 more

Published Apr 20, 2026

Tracked Since Apr 20, 2026