Vulnerability Description
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.
References
FAQ
What is CVE-2026-51915?
CVE-2026-51915 is a documented vulnerability. TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a ca...
How severe is CVE-2026-51915?
CVSS scoring is not yet available for CVE-2026-51915. Check NVD for updates.
Is there a patch for CVE-2026-51915?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.