CVE-2026-51904

{
  "etk_id": "ETK-2026-584",
  "cve_id": "CVE-2026-51904",
  "display_id": "CVE-2026-51904",
  "ghsa_id": "GHSA-63jh-v3gf-wqcq",
  "euvd_id": "EUVD-2026-91702",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Cross-organization authorization flaw in SuperAGI agent execution",
  "summary": "SuperAGI through 0.0.14 does not consistently enforce organization ownership when creating or starting agent execution records. An authenticated user from one organization may trigger execution activity for an agent belonging to another organization if they can reference that agent.",
  "mitigation": "Add server-side checks that the requested agent belongs to the caller’s organization before creating or starting executions. Until a corrected release is confirmed, limit access to agent-execution functions to trusted users and review cross-organization execution records.",
  "vendor": null,
  "product": "SuperAGI",
  "affected": [
    {
      "affected_notes": [
        "n/a"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "n/a",
      "purl": null
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 9.8,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0041,
  "epss_percentile": 0.3374,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 41.209654,
  "t0_at": "2026-10-02T00:00:00+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-02T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-02T00:00:00+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-51904"
    }
  }
}