CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2024-12048
High (8.8) in superagi superagi. EPSS 0.7% chance of exploitation in the next 30 days.
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-639, CWE-304
- Published
- Modified
- Record from
- the NVD, synced
Affected
- superagi:superagi