CVE-2026-51903

SuperAGI latest-execution lookup can cross organization boundaries

TransformerOptimus · SuperAGI latest agent-execution lookup

First documented disclosure · Review checkpoint

Summary

A logged-in user can retrieve another organization's latest agent execution.

Severity and exploitation evidence

Unknown · numeric CVSS score not recorded. Severity source.

Exploitation not established: The researcher describes authorized local cross-organization testing. No reviewed source establishes malicious exploitation or confirmed victims.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

get_agent_by_latest_execution selects data using a caller-supplied project ID without the required organization ownership check.

Conditions required

A multi-organization deployment, an ordinary authenticated account and knowledge or discovery of the target identifiers.

Potential impact

Disclosure of latest execution and agent metadata for another organization.

Affected versions and configurations

v0.0.14 according to the CNA.

Fix and mitigation status

No issue-specific fixed release is established in the reviewed sources.

Practical next steps

Restrict exposure and isolate organizations until ownership checks are fixed. Validate the selected project, agent and execution against the authenticated organization; verify with two-user regression checks.

Operating lesson

Apply authorization to execution-history lookups as well as agent-management routes.

Evidence and limits

The earliest verified specific disclosure is the September 26 researcher gist; the CNA followed October 29. No earlier issue or fix mapping was established. The published CNA has no CVSS score; numeric severity is not inferred from the impact.

Sources