Chaitanyagarware

An issue exists in the `backend/src/controllers/memory.controller.js` file where requests are authenticated, but the `listMemories`, `deleteMemory`, and `clearAgentMemory` functions fail to verify if the record associated with the caller-supplied `agentId` or memory ` id` belongs to the `req.user`. This lack of ownership verification allows an authenticated attacker with knowledge of another user's identifiers to access sensitive AgentMemory content, such as conversation history, agent context, task data, embeddings, and metadata. Additionally, the attacker can delete specific memories or clear all memory for a victim agent, resulting in a breach of tenant isolation, unauthorized data disclosure, and data loss.

An authenticated user capable of creating or modifying workflow file steps can exploit a path traversal flaw in the `executeStep` file-step implementation located in `backend/src/agents/executor.js`. The system passes the user-controlled `step.path` variable through `path.resolve` with `process.cwd()` and performs read or write operations without verifying if the resulting path remains within an approved workflow directory. This allows an attacker to use traversal segments to escape the intended workspace, enabling the reading of sensitive files or the writing and overwriting of files accessible to the backend process, including application-adjacent files depending on process permissions.

Authenticated users can perform blind Server-Side Request Forgery (SSRF) attacks by specifying internal loopback or private network destinations in the `delivery address` parameter during the creation of webhook subscriptions. By triggering matching fact-change events, an attacker can force the server to send HTTP POST requests to internal services and private network endpoints.