---
id: "CVE-2026-51902"
kind: "vulnerability"
aliases: ["CVE-2026-51902"]
title: "SuperAGI: authenticated users can list another organization's agents"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "SuperAGI", "fixed": [], "affected": "<= 0.0.14", "ecosystem": "github"}]
ecosystems: []
tags: ["ai-tooling", "multi-tenant", "self-hosted", "superagi"]
not_affected_if: ["no-untrusted-accounts", "single-organization"]
published_at: "2026-10-29T18:17:32+00:00"
first_seen_at: "2026-10-29T18:26:34+00:00"
updated_at: "2026-10-29T18:29:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-51902", "first_seen_at": "2026-10-29T18:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T18:29:34+00:00"}]
---

# SuperAGI: authenticated users can list another organization's agents

SuperAGI up to v0.0.14 has an endpoint that returns the full list of agents for any project ID, without checking that the project belongs to the caller's organization. An logged-in user from one organization can read the agents of another organization's project.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:SuperAGI affected <= 0.0.14 fixed ?

## How to check

- Run SuperAGI v0.0.14 or earlier (latest release, no fix).
- In superagi/controllers/agent.py, check get_agents_by_project_id (GET /api/agents/get/project/{project_id}): if it does not compare the project's organisation to the caller's, you are exposed.
- Only matters if more than one organization or untrusted accounts share the instance.

## Fix

No fixed release as of 2026-10-29: v0.0.14 is the latest release and upstream issue #1558 is open. Until a patch ships, restrict accounts or add an organization check on get_agents_by_project_id (superagi/controllers/agent.py).

## Timeline

- 2026-10-29T18:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-51902
- 2026-10-29T18:29:34+00:00 analyst — Reporter's issue #1558 (open since 2026-05-27, no maintainer reply) describes the flaw at agent.py:333; latest release is v0.0.14, no fix found. Sibling SuperAGI access-control CVEs (51899, 51904) are unpatched too. Nothing marked verified: only the reporter's issue and releases page were read.

## Documents

- [advisory] Cross-Organization Agent List Disclosure via Project ID (#1558, open) https://github.com/TransformerOptimus/SuperAGI/issues/1558
- [mentions] SuperAGI releases (latest v0.0.14) https://github.com/TransformerOptimus/SuperAGI/releases

## From the sources

SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_