CVE-2024-12048CWE-304

IDOR Vulnerability in transformeroptimus/superagi

High · published March 20, 2025

CVSS v3.0
8.8
EPSS
1%
Percentile
54.1
In the wild
Unconfirmed
What it is

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00742 · 54.1th percentile
Weakness
CWE-304 · Missing Critical Step in Authentication
Published
2025-03-20T10:11Z
EPSS history
Timeline
  • 20 MAR 10:11Z
    IDOR Vulnerability in transformeroptimus/superagi
    cvelistv5