PT-2026-33720 · Superagi · Superagi

Eric-Z · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6613

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions prior to 0.0.15

Description Remote authorization bypass occurs due to the manipulation of the agent id argument. This issue affects the functions delete agent(), stop schedule(), and get schedule data() within the file 'superagi/controllers/agent.py'.

Recommendations Update to a version later than 0.0.14. As a temporary workaround, restrict access to the functions delete agent(), stop schedule(), and get schedule data() to minimize the risk of exploitation.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-6613

Affected Products

Superagi

References · 6

• 🔥 https://gist.github.com/YLChen-007/1d87985b274ce22c4294726d7758df8e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6613 · Security Note
• https://vuldb.com/vuln/358248/cti · Note
• https://vuldb.com/submit/791081 · Note
• https://vuldb.com/vuln/358248 · Note
• https://twitter.com/VulmonFeeds/status/2046175008469254613 · Twitter Post