{"id":"CVE-2026-51903","kind":"vulnerability","aliases":["CVE-2026-51903"],"related":[],"title":"SuperAGI: authenticated users can read other organizations' agent execution metadata","description":"SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py. A remote authenticated attacker from one organization can retrieve latest execution and agent metadata for another organization's project through /agentexecutions/get/latest/agent/project/{project_id} by supplying a victim project_id.","summary":"SuperAGI v0.0.14 lets a logged-in user from one organization fetch the latest execution and agent metadata of another organization's project by supplying that project's ID to an API endpoint. The attacker gets exposure of another tenant's agent activity data, not code execution.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SuperAGI","fixed":[],"affected":"<= 0.0.14","ecosystem":"github"}],"ecosystems":[],"tags":["ai-agents","ai-tooling","multi-tenant","self-hosted","superagi"],"not_affected_if":["auth-required","no-untrusted-accounts","single-tenant"],"how_to_check":"- Check whether the SuperAGI version in use is `0.0.14`, for example in the deployed image tag or repository release.\n- Review `superagi/controllers/agent_execution.py` for the `get_agent_by_latest_execution` handler and whether it verifies the project belongs to the caller's organization.\n- Test whether `/agentexecutions/get/latest/agent/project/{project_id}` returns data for a project ID outside your organization's tenant (unknown if sources give a test procedure).","fix":null,"status":"open","published_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","triaged_at":"2026-10-29T18:28:50+00:00","updated_at":"2026-10-29T18:29:38+00:00","category":"ai-tooling","confidence":0.5,"triage":{"at":"2026-10-29T18:28:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SuperAGI: authenticated users can read other organizations' agent execution metadata","impact":"low","summary":"SuperAGI v0.0.14 lets a logged-in user from one organization fetch the latest execution and agent metadata of another organization's project by supplying that project's ID to an API endpoint. The attacker gets exposure of another tenant's agent activity data, not code execution.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["superagi","self-hosted","multi-tenant","ai-agents"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads another organization's agent execution metadata","analyst_note":"Find the fixed SuperAGI version and any patch commit at https://nvd.nist.gov/vuln/detail/CVE-2026-51903 or the project repository.","how_to_check":"- Check whether the SuperAGI version in use is `0.0.14`, for example in the deployed image tag or repository release.\n- Review `superagi/controllers/agent_execution.py` for the `get_agent_by_latest_execution` handler and whether it verifies the project belongs to the caller's organization.\n- Test whether `/agentexecutions/get/latest/agent/project/{project_id}` returns data for a project ID outside your organization's tenant (unknown if sources give a test procedure).","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant","no-untrusted-accounts"],"who_is_affected":"Teams that run SuperAGI with multiple organizations or tenants sharing one instance are the ones exposed, since the flaw is cross-organization access. A single-tenant deployment where every user belongs to the same organization is less exposed. The sources do not state which fixed version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4145,"output_tokens":668,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed SuperAGI version and any patch commit at https://nvd.nist.gov/vuln/detail/CVE-2026-51903 or the project repository.","search":"'-2026':12A,15A '-51903':13A,16A '/agentexecutions/get/latest/agent/project':114C 'access':83C 'activ':73B 'agent':8A,20B,47B,72B,88C,106C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'anoth':50B,69B,109C 'api':62B 'attack':65B,97C 'authent':2A,96C 'code':76B 'contain':80C 'control':84C 'cve':11A,14A 'data':74B 'endpoint':63B 'execut':9A,45B,77B,91C,104C 'exposur':67B 'fetch':42B 'get':66B,87C 'host':29B 'id':59B,116C,122C 'improp':82C 'latest':44B,90C,103C 'let':33B 'log':36B 'logged-in':35B 'metadata':10A,48B,107C 'multi':25B 'multi-ten':24B 'one':40B,99C 'organ':7A,41B,51B,100C,110C 'project':53B,57B,112C,115C,121C 'read':5A 'remot':95C 'retriev':102C 'self':28B 'self-host':27B 'superagi':1A,17A,30B,31B,78C 'superagi/controllers/agent_execution.py':93C 'suppli':55B,118C 'tenant':26B,70B 'tool':23B 'user':3A,38B 'v0.0.14':32B,79C 'victim':120C 'vulner':85C","nicknames":[],"mitigations":[],"who_affected":"Teams that run SuperAGI with multiple organizations or tenants sharing one instance are the ones exposed, since the flaw is cross-organization access. A single-tenant deployment where every user belongs to the same organization is less exposed. The sources do not state which fixed version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T18:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-51903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-51903","severity":null,"published_at":"2026-10-29T18:17:32+00:00","modified_at":"2026-10-29T18:17:32+00:00","first_seen_at":"2026-10-29T18:26:34+00:00","fetched_at":"2026-10-29T18:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-51903:1092","url":null,"severity":null,"published_at":"2026-10-29T18:29:38+00:00","modified_at":"2026-10-29T18:29:38+00:00","first_seen_at":"2026-10-29T18:29:38+00:00","fetched_at":"2026-10-29T18:29:38+00:00","note":"No NVD/vendor page readable and no page found for this CVE id; no fix or patch commit located. Sibling SuperAGI authz CVEs (CVE-2026-6612, 51904) report vendor unresponsive, all up to 0.0.14, so fix left unknown. Nothing verified."}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}