# CVE-2024-12048

## Summary

- **CVE ID:** CVE-2024-12048
- **Severity:** HIGH
- **CVSS Score:** 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** CWE-304
- **Published:** Mar 20, 2025
- **Last Modified:** Mar 13, 2026

## Description

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.

## Affected Products

- transformeroptimus — transformeroptimus/superagi (unspecified)

## References

- [CNA](https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b48f37dc)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.71%
- **EPSS Percentile:** 51.6

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._