PT-2026-33721 · Unknown · Transformeroptimus/Superagi

Eric-Z · Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-6614

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions TransformerOptimus SuperAGI versions prior to 0.0.15

Description A flaw in the get project(), update project(), and get projects organisation() functions within the superagi/controllers/project.py file allows for a remote authorization bypass. This occurs when an attacker manipulates requests to bypass security checks.

Recommendations Update to a version later than 0.0.14. As a temporary workaround, restrict access to the get project(), update project(), and get projects organisation() functions until a patch is applied.

Exploit

Fix

Improper Authorization

IDOR

Weakness Enumeration

CWE-285

CWE-639

Related Identifiers

CVE-2026-6614

Affected Products

Transformeroptimus/Superagi

References · 6

• 🔥 https://gist.github.com/YLChen-007/ac40da2253c7364d043c0dfe3275190b · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-6614 · Security Note
• https://vuldb.com/submit/791082 · Note
• https://vuldb.com/vuln/358249 · Note
• https://vuldb.com/vuln/358249/cti · Note
• https://twitter.com/VulmonFeeds/status/2046177567984492680 · Twitter Post