{"dataType":"CVE_RECORD","cveMetadata":{"state":"PUBLISHED","cveId":"CVE-2026-51902","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","dateUpdated":"2026-10-29T18:07:12.279Z","dateReserved":"2026-06-08T00:00:00.000Z","datePublished":"2026-10-29T00:00:00.000Z"},"containers":{"cna":{"providerMetadata":{"orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre","dateUpdated":"2026-10-29T18:07:12.279Z"},"descriptions":[{"lang":"en","value":"SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://github.com/TransformerOptimus/SuperAGI/issues/1558"},{"url":"https://gist.github.com/Ro1ME/68d7dfa6ecc41caa9945a02dd31156ca"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}]}},"dataVersion":"5.2"}