Authorization Bypass Vulnerability in AutoGPT Platform

CVE-2025-53944

What is CVE-2025-53944?

The AutoGPT platform, designed to facilitate the creation and management of AI agents, contains an authorization bypass vulnerability in versions v0.6.15 and earlier. This flaw exists within the get_graph_execution_results endpoint of the external API, where it appropriately validates user access to the graph_id. However, it inadequately checks the ownership of the graph_exec_id parameter, allowing authenticated users to exploit the issue by gaining unauthorized access to any execution results. The internal API ensures correct validation, but this gap poses significant security risks. The vulnerability has been addressed in version v0.6.16, which enhances the validation process to safeguard sensitive data.

References