| Titre | SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639) |
|---|
| Description | # Technical Details
An Insecure Direct Object Reference (IDOR) exists in the `get_budget` and `update_budget` methods in `superagi/controllers/budget.py` of SuperAGI.
The application fails to verify that the target budget belongs to the requesting user's organization. Both endpoints only validate the JWT token via `Depends(check_auth)` but perform no ownership check on the `budget_id` URL parameter.
# Vulnerable Code
File: superagi/controllers/budget.py
Method: get_budget (lines 54-71), update_budget (lines 74-97)
Why: Both endpoints query `Budget.id == budget_id` using an attacker-controlled parameter without filtering by organization_id, allowing any authenticated user to read or overwrite any organization's budget limits.
# Reproduction
1. Authenticate with an attacker account and obtain a valid JWT.
2. Read the victim's budget:
curl -s -H "Authorization: Bearer $JWT" "http://localhost:3000/api/budgets/get/1"
3. Set the victim's budget to 0 to block their agents:
curl -s -X PUT -H "Authorization: Bearer $JWT" -H "Content-Type: application/json" "http://localhost:3000/api/budgets/update/1" -d '{"budget": 0, "cycle": "daily"}'
# Impact
- Financial Manipulation: Attacker can increase their own budget or reduce a victim's budget limits.
- Service Disruption: Setting a budget to 0 blocks the victim's agents from executing any tasks.
|
|---|
| La source | ⚠️ https://gist.github.com/YLChen-007/4b6b95f98aeed927a99d2a76eaf53444 |
|---|
| Utilisateur | Eric-z (UID 95890) |
|---|
| Soumission | 27/03/2026 12:51 (il y a 24 jours) |
|---|
| Modérer | 19/04/2026 07:41 (23 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 358221 [TransformerOptimus SuperAGI jusqu’à 0.0.14 Budget Endpoint budget.py get_budget/update_budget élévation de privilèges] |
|---|
| Points | 20 |
|---|