CVE-2024-12048
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
20/03/2025
Last modified:
20/03/2025
Description
An IDOR (Insecure Direct Object Reference) vulnerability exists in transformeroptimus/superagi version v0.0.14. The application fails to properly check authorization for multiple API endpoints, allowing attackers to view, edit, and delete other users' information without proper authorization. Affected endpoints include but are not limited to /get/project/{project_id}, /get/schedule_data/{agent_id}, /delete/{agent_id}, /get/organisation/{organisation_id}, and /get/user/{user_id}.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH