CVE-2026-51905

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get agent execution configuration in superagi/controllers/agent execution config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent id and agent execution id to /agent executions configs/details/agent id/{agent id}/agent execution id/{agent execution id}. The endpoint lacks an organization ownership check on the selected agent and execution.