CVE-2024-12048: IDOR Vulnerability in transformeroptimus/superagi

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-03-20 · updated 2026-06-17
Weakness: CWE-304

Description

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.

Affected products

TransformerOptimus SuperAGI: 0.0.14

References

https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc
https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc

Get alerted when CVE-2024-12048 or the next vulnerability affects your stack