Insecure Direct Object Reference in transformeroptimus/superagi
CVE-2024-12048

8.8HIGH

Key Information:

Vendor

Transformeroptimus

Status
Transformeroptimus/superagi
Vendor
CVE Published:
20 March 2025

What is CVE-2024-12048?

An Insecure Direct Object Reference vulnerability exists in transformeroptimus/superagi version v0.0.14. This flaw allows unauthorized users to access sensitive endpoints without proper authorization checks. Specifically, attackers can manipulate API calls to view, edit, and delete information belonging to other users. Key endpoints affected include using project identifiers, schedule data, user details, and organization information, leading to potential data breaches and unauthorized actions.

Affected Version(s)

transformeroptimus/superagi <= unspecified

References

https://huntr.com/bounties/6def3e3a-c443-44bb-b20e-3e69b4...

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.