CVE-2024-12048
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.8
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.71%
- CWE
- CWE-304
- Published
- 2025-03-20
- Last modified
- 2026-03-13
Affected products
- transformeroptimus transformeroptimus/superagi
Weakness type
Related vulnerabilities
- CVE-2023-54391 — Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
- CVE-2026-59564 — Authentication bypass between ZCC and client connector portal
- CVE-2026-76207 — phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie
- CVE-2026-49467 — TOTP enrollment hijack: password gate skipped due to unawaited promise
- CVE-2026-61466 — Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
- CVE-2026-67351 — Serendipity < 2.6.1 Authentication Bypass via Username Collision
- CVE-2026-55957 — Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind
- CVE-2026-57915 — Apache Kerby: Kerberos Pre-Authentication Bypass