Skip to main content

Missing Critical Step in Authentication

CVE-2024-12048

High
8.8/10

Summary

An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • HIGH

CWE-304 - Missing Critical Step in Authentication

The software implements an authentication technique, but it skips a step that weakens the technique.

References

Advisory Timeline

  • Published