CVE-2026-6585: fallo de gravedad media en TransformerOptimus SuperAGI
TransformerOptimus SuperAGI Organisation Update Endpoint organisation.py update_organisation authorization
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
33Vexday Risk Score
Sin señal de explotación. Ella tiene prueba de concepto pública.
ssvc Attendcvss 5.3epss 0.3%
A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controllers/organisation.py of the component Organisation Update Endpoint. This manipulation of the argument organisation_id causes authorization bypass. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Productos afectados
TransformerOptimus · SuperAGIPoCs públicas encontradas — 1
cve_referencegist.github.com/YLChen-007/88ea045efa387ab0b93f6dd2f797e653no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — TransformerOptimus SuperAGI
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-6280MEDIUMTransformerOptimus SuperAGI EmailToolKit read_email.py download_attachment path traversalEPSS 0.6%CVE-2026-6615MEDIUMTransformerOptimus SuperAGI Multipart Upload resources.py upload path traversalEPSS 0.5%CVE-2026-6582MEDIUMTransformerOptimus SuperAGI Vector Database Management Endpoint vector_dbs.py get_vector_db_details missing authenticationEPSS 0.4%CVE-2026-6612MEDIUMTransformerOptimus SuperAGI Agent Execution Endpoint agent_execution.py update_agent_execution authorizationEPSS 0.3%CVE-2026-6584MEDIUMTransformerOptimus SuperAGI User Update Endpoint user.py update_user authorizationEPSS 0.3%CVE-2026-6583MEDIUMTransformerOptimus SuperAGI API Key Management Endpoint api_key.py edit_api_key authorizationEPSS 0.3%