{"id":"CVE-2026-51899","revision":"8f8a0d383d704c67bf4a9f06d41f4f91","records":[{"revision":"8f8a0d383d704c67bf4a9f06d41f4f91","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-51899","aliases":[],"title":"In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, ed…","description":"In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from one organization to create, schedule, edit, stop, and delete agents belonging to a different organization's project. The endpoints accept a project_id parameter but do not verify that the project belongs to the authenticated user's organization.","state":0,"publishedAt":"2026-10-02T00:00:00+00:00","modifiedAt":"2026-10-02T20:23:14.738+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"n/a\",\n                    \"product\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"version\": \"n/a\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/TransformerOptimus/SuperAGI/issues/1556","https://gist.github.com/Ro1ME/c1e18e9c64c324db0bccfaa547eb2d05"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-51899","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-51899","identifiers":["CVE-2026-51899"]},"retained":false,"historicalAffected":[]}],"coverage":[]}