Information Disclosure Vulnerability in Superagi by Transformeroptimus

CVE-2024-9447

What is CVE-2024-9447?

An information disclosure vulnerability has been identified in the latest version of Superagi by Transformeroptimus. The flaw exists within the /get/organisation/ endpoint, which fails to adequately verify whether the authenticated user belongs to the specified organization. This oversight allows any authenticated user to access sensitive configuration information, including API keys of other organizations. The potential implications are severe, including unauthorized access to third-party services and significant security breaches.

References