CVE-2026-51899 in SuperAGI
Summary
by MITRE • 10/02/2026
In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in SuperAGI versions 0.0.14 and prior represents a critical failure in access control mechanisms, specifically manifesting as an insecure direct object reference or broken function level access issue. This flaw affects several core controller endpoints responsible for the lifecycle management of AI agents, including creation, scheduling, editing schedules, stopping scheduled tasks, and deletion. The affected paths include /api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, and /api/agents/stop_schedule. These endpoints are designed to handle sensitive operations that modify the state of autonomous agents within a multi-tenant architecture where distinct organizations operate independently with isolated projects and data sets.
The technical root cause lies in the server-side validation logic associated with these API routes. While the application correctly authenticates users, ensuring they have valid credentials to access the system, it fails to perform an authorization check regarding resource ownership. Specifically, when a request is received containing a project_id parameter, the backend processes this identifier without verifying that the specified project belongs to the organization of the authenticated user making the request. This absence of cross-tenant validation allows any authenticated user to supply arbitrary identifiers for projects belonging to other organizations within the same SuperAGI instance. By manipulating this input parameter, an attacker can bypass logical boundaries intended to separate tenant data and operations.
From a classification perspective, this vulnerability aligns with CWE-639, which describes Authorization Bypass Through User-Controlled Key, as well as CWE-284, Improper Access Control. In the context of the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1078 Valid Accounts and potentially T1530 Data from Cloud Storage if sensitive data within those agents or projects is exfiltrated through these endpoints. The flaw essentially treats internal object identifiers as trusted inputs without validating their association with the current session's context, a common pitfall in RESTful API design when multi-tenancy is implemented incorrectly.
The operational impact of this vulnerability is severe due to the nature of the actions permitted by the affected endpoints. An authenticated attacker can create new agents within another organization's project, potentially injecting malicious configurations or unauthorized automation scripts that consume resources or perform unintended actions on behalf of the victim organization. Furthermore, attackers can schedule tasks for other organizations' agents, leading to resource exhaustion, data corruption, or execution of harmful commands if those agents have access to external systems. The ability to edit schedules allows an attacker to disrupt operational workflows by changing timing parameters critical to business processes. Most critically, the capability to delete agents and stop scheduled operations results in a denial of service for legitimate users within the targeted organization, causing significant disruption to automated tasks and potentially leading to data loss if agent states are not properly backed up or recoverable.
Mitigation strategies must focus on implementing robust server-side authorization checks at every endpoint that interacts with tenant-specific resources. Developers should ensure that after authenticating a user, the application retrieves the associated organization ID from the session or token context and validates it against the ownership metadata of the requested project_id before executing any business logic. This validation step is essential to enforce strict isolation between tenants in multi-tenant applications. Additionally, implementing comprehensive logging for access control failures can aid in detecting attempted exploitation attempts. Updating to a patched version that resolves this logical flaw is imperative for maintaining the integrity and confidentiality of organizational data within the SuperAGI platform.