{"id":"CVE-2026-51902","kind":"vulnerability","aliases":["CVE-2026-51902"],"related":[],"title":"SuperAGI: authenticated users can list another organization's agents","description":"SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.","summary":"SuperAGI up to v0.0.14 has an endpoint that returns the full list of agents for any project ID, without checking that the project belongs to the caller's organization. An logged-in user from one organization can read the agents of another organization's project.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SuperAGI","fixed":[],"affected":"<= 0.0.14","ecosystem":"github"}],"ecosystems":[],"tags":["ai-tooling","multi-tenant","self-hosted","superagi"],"not_affected_if":["no-untrusted-accounts","single-organization"],"how_to_check":"- Run SuperAGI v0.0.14 or earlier (latest release, no fix).\n- In superagi/controllers/agent.py, check get_agents_by_project_id (GET /api/agents/get/project/{project_id}): if it does not compare the project's organisation to the caller's, you are exposed.\n- Only matters if more than one organization or untrusted accounts share the instance.","fix":"No fixed release as of 2026-10-29: v0.0.14 is the latest release and upstream issue #1558 is open. Until a patch ships, restrict accounts or add an organization check on get_agents_by_project_id (superagi/controllers/agent.py).","status":"open","published_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","triaged_at":"2026-10-29T18:28:50+00:00","updated_at":"2026-10-29T18:29:34+00:00","category":"ai-tooling","confidence":0.75,"triage":{"at":"2026-10-29T18:28:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SuperAGI: authenticated users can list another organization's agents","impact":"low","summary":"SuperAGI up to v0.0.14 has an endpoint that returns the full list of agents for any project ID, without checking that the project belongs to the caller's organization. An logged-in user from one organization can read the agents of another organization's project.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["superagi","self-hosted","multi-tenant"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads another organization's agent list","analyst_note":"Confirm the fixed version and whether any patch exists; the NVD entry alone does not state either.","how_to_check":"- Check the installed SuperAGI version against `v0.0.14`; versions up to and including it are listed as affected.\n- Look for the route `/api/agents/get/project/{project_id}` in your deployment and confirm whether it checks the caller's organization.","plain_action":"","needs_analyst":true,"not_affected_if":["single-organization","no-untrusted-accounts"],"who_is_affected":"Teams that run SuperAGI with more than one organization or tenant using the same instance. The exposure is the agent listing endpoint, which accepts a project ID and does not verify organization ownership. Single-organization deployments have less exposure, though the sources do not say how much.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":4130,"output_tokens":531,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether any patch exists; the NVD entry alone does not state either.","search":"'-2026':11A,14A '-51902':12A,15A '/api/agents/get/project':87C 'accept':112C 'access':80C 'agent':9A,40B,67B,84C,102C 'ai':18B 'ai-tool':17B 'allow':90C 'anoth':6A,69B 'authent':2A,91C,127C 'belong':50B,103C,124C 'caller':53B 'check':46B 'complet':99C 'contain':77C 'control':81C,85C 'cve':10A,13A 'differ':106C 'endpoint':33B,86C,111C 'full':37B 'host':25B 'id':44B,89C,115C 'improp':79C 'list':5A,38B,100C 'log':58B 'logged-in':57B 'multi':21B 'multi-ten':20B 'one':62B,94C 'organ':7A,55B,63B,70B,95C,107C,130C 'paramet':116C 'project':43B,49B,72B,88C,109C,114C,123C 'read':65B 'retriev':97C 'return':35B 'self':24B 'self-host':23B 'superagi':1A,16A,26B,27B,73C 'tenant':22B 'tool':19B 'user':3A,60B,92C,128C 'v0.0.14':30B,76C 'verifi':120C 'vulner':82C 'without':45B","nicknames":[],"mitigations":[],"who_affected":"Teams that run SuperAGI with more than one organization or tenant using the same instance. The exposure is the agent listing endpoint, which accepts a project ID and does not verify organization ownership. Single-organization deployments have less exposure, though the sources do not say how much.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T18:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-51902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51902","severity":null,"published_at":"2026-10-29T18:17:32+00:00","modified_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","fetched_at":"2026-10-29T18:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-51902:1093","url":null,"severity":null,"published_at":"2026-10-29T18:29:34+00:00","modified_at":"2026-10-29T18:29:34+00:00","first_seen_at":"2026-10-29T18:29:34+00:00","fetched_at":"2026-10-29T18:29:34+00:00","note":"Reporter's issue #1558 (open since 2026-05-27, no maintainer reply) describes the flaw at agent.py:333; latest release is v0.0.14, no fix found. Sibling SuperAGI access-control CVEs (51899, 51904) are unpatched too. Nothing marked verified: only the reporter's issue and releases page were read."}],"documents":[{"id":18576,"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1558","title":"Cross-Organization Agent List Disclosure via Project ID (#1558, open)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":18577,"url":"https://github.com/TransformerOptimus/SuperAGI/releases","title":"SuperAGI releases (latest v0.0.14)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}