CVE-2026-51902

SuperAGI agent listing omits organization ownership checks

TransformerOptimus · SuperAGI agent project listing

First documented disclosure · Review checkpoint

Summary

One organization's user can retrieve another organization's agent list.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: The researcher describes authorized local cross-organization testing. No reviewed source establishes malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The project-list endpoint accepts a project ID and queries its agents without binding the project to the caller's organization.

Conditions required

A multi-organization deployment, an ordinary authenticated account and knowledge or discovery of the target identifiers.

Potential impact

Exposure of agent identifiers, configuration details and operational metadata.

Affected versions and configurations

Up to v0.0.14 according to the CNA.

Fix and mitigation status

No issue-specific fixed release is established in the reviewed sources.

Practical next steps

Restrict exposure and isolate organizations until ownership checks are fixed. Validate the selected project, agent and execution against the authenticated organization; verify with two-user regression checks.

Operating lesson

Check tenant ownership on every parent resource used to fetch agent data.

Evidence and limits

The May 27 public issue predates the September 26 gist and October 29 CVE publication. The issue remains open. The published CNA has no CVSS score; numeric severity is not inferred from the impact.

Sources