CVE-2026-51901

{
  "etk_id": "ETK-2026-583",
  "cve_id": "CVE-2026-51901",
  "display_id": "CVE-2026-51901",
  "ghsa_id": "GHSA-mv3w-9m62-vw4g",
  "euvd_id": "EUVD-2026-91703",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-organization authorization bypass in SuperAGI scheduling",
  "summary": "SuperAGI versions through 0.0.14 do not properly scope agent-scheduling requests to the caller's organization. An authenticated user from one organization may trigger scheduling for an agent belonging to another organization when they can reach the affected scheduling endpoint.",
  "mitigation": "Restrict or disable access to the agent-execution scheduling endpoint until organization ownership is enforced for every requested agent. Limit credentials for this function to trusted users and monitor scheduling activity for cross-organization requests.",
  "vendor": null,
  "product": "SuperAGI",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 8.1,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": 0.0025,
  "epss_percentile": 0.158,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 46.09046678333333,
  "t0_at": "2026-10-02T00:00:00+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T00:00:00+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-51901"
    }
  }
}