CVE-2026-6584

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6584", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-19T05:41:06.301Z", "datePublished": "2026-04-19T23:15:16.091Z", "dateUpdated": "2026-04-20T15:07:48.363Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T23:15:16.091Z"}, "title": "TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-639", "lang": "en", "description": "Authorization Bypass"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-285", "lang": "en", "description": "Improper Authorization"}]}], "affected": [{"vendor": "TransformerOptimus", "product": "SuperAGI", "versions": [{"version": "0.0.1", "status": "affected"}, {"version": "0.0.2", "status": "affected"}, {"version": "0.0.3", "status": "affected"}, {"version": "0.0.4", "status": "affected"}, {"version": "0.0.5", "status": "affected"}, {"version": "0.0.6", "status": "affected"}, {"version": "0.0.7", "status": "affected"}, {"version": "0.0.8", "status": "affected"}, {"version": "0.0.9", "status": "affected"}, {"version": "0.0.10", "status": "affected"}, {"version": "0.0.11", "status": "affected"}, {"version": "0.0.12", "status": "affected"}, {"version": "0.0.13", "status": "affected"}, {"version": "0.0.14", "status": "affected"}], "cpes": ["cpe:2.3:a:superagi:superagi:*:*:*:*:*:*:*:*"], "modules": ["User Update Endpoint"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-19T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-19T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-19T07:46:11.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Eric-z (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/358219", "name": "VDB-358219 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358219/cti", "name": "VDB-358219 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/791075", "name": "Submit #791075 | SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/79b967ece52d424558f279156dd53324", "tags": ["exploit"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-20T15:07:41.315185Z", "id": "CVE-2026-6584", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:07:48.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6584", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-20T15:07:41.315185Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-20T15:07:44.421Z"}}], "cna": {"title": "TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization", "credits": [{"lang": "en", "type": "reporter", "value": "Eric-z (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.5, "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"cpes": ["cpe:2.3:a:superagi:superagi:*:*:*:*:*:*:*:*"], "vendor": "TransformerOptimus", "modules": ["User Update Endpoint"], "product": "SuperAGI", "versions": [{"status": "affected", "version": "0.0.1"}, {"status": "affected", "version": "0.0.2"}, {"status": "affected", "version": "0.0.3"}, {"status": "affected", "version": "0.0.4"}, {"status": "affected", "version": "0.0.5"}, {"status": "affected", "version": "0.0.6"}, {"status": "affected", "version": "0.0.7"}, {"status": "affected", "version": "0.0.8"}, {"status": "affected", "version": "0.0.9"}, {"status": "affected", "version": "0.0.10"}, {"status": "affected", "version": "0.0.11"}, {"status": "affected", "version": "0.0.12"}, {"status": "affected", "version": "0.0.13"}, {"status": "affected", "version": "0.0.14"}]}], "timeline": [{"lang": "en", "time": "2026-04-19T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-19T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-19T07:46:11.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/358219", "name": "VDB-358219 | TransformerOptimus SuperAGI User Update Endpoint user.py update_user authorization", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/358219/cti", "name": "VDB-358219 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/791075", "name": "Submit #791075 | SuperAGI up to c3c1982 Authorization Bypass Through User-Controlled Key (CWE-639)", "tags": ["third-party-advisory"]}, {"url": "https://gist.github.com/YLChen-007/79b967ece52d424558f279156dd53324", "tags": ["exploit"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "Authorization Bypass"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-285", "description": "Improper Authorization"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-19T23:15:16.091Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6584", "state": "PUBLISHED", "dateUpdated": "2026-04-20T15:07:48.363Z", "dateReserved": "2026-04-19T05:41:06.301Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-19T23:15:16.091Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:superagi:superagi:*:*:*:*:*:*:*:*"], "modules": ["User Update Endpoint"], "product": "SuperAGI", "vendor": "TransformerOptimus", "versions": [{"status": "affected", "version": "0.0.1"}, {"status": "affected", "version": "0.0.2"}, {"status": "affected", "version": "0.0.3"}, {"status": "affected", "version": "0.0.4"}, {"status": "affected", "version": "0.0.5"}, {"status": "affected", "version": "0.0.6"}, {"status": "affected", "version": "0.0.7"}, {"status": "affected", "version": "0.0.8"}, {"status": "affected", "version": "0.0.9"}, {"status": "affected", "version": "0.0.10"}, {"status": "affected", "version": "0.0.11"}, {"status": "affected", "version": "0.0.12"}, {"status": "affected", "version": "0.0.13"}, {"status": "affected", "version": "0.0.14"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/user.py of the component User Update Endpoint. The manipulation of the argument user_id results in authorization bypass. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}, {"lang": "es", "value": "Una vulnerabilidad fue encontrada en TransformerOptimus SuperAGI hasta 0.0.14. Esta vulnerabilidad afecta a la funci\u00f3n update_user del archivo superagi/controllers/user.py del componente User Update Endpoint. La manipulaci\u00f3n del argumento user_id resulta en omisi\u00f3n de autorizaci\u00f3n. El ataque puede ser realizado desde remoto. El exploit ha sido hecho p\u00fablico y podr\u00eda ser utilizado. El proveedor fue contactado tempranamente sobre esta divulgaci\u00f3n pero no respondi\u00f3 de ninguna manera."}], "id": "CVE-2026-6584", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 5.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6584", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-20T15:07:41.315185Z", "version": "2.0.3"}}]}, "published": "2026-04-20T00:16:34.093", "references": [{"source": "cna@vuldb.com", "url": "https://gist.github.com/YLChen-007/79b967ece52d424558f279156dd53324"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/791075"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358219"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/358219/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}, {"lang": "en", "value": "CWE-639"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.0.14"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "SuperAGI", "source": "cna", "vendor": "TransformerOptimus"}, "product": "superagi", "vendor": "superagi"}], "analysis": {"en": {"generated_at": "2026-04-20T00:20:44.112720+00:00", "value": {"mitigation_remediation": ["Upgrade SuperAGI to 0.0.15 or newer once available.", "Restrict the update_user endpoint to authenticated users and verify the user_id against the session\u2019s user identity before processing the request.", "Implement server\u2011side validation to ensure that only authorized roles (e.g., administrators) can modify other users\u2019 accounts."], "summary": {"action": "Apply Patch", "impact": "Authorization Bypass"}, "threat_synthesis": {"affected_systems": "TransformerOptimus SuperAGI versions up to 0.0.14 are affected. The issue occurs within the SuperAGI application, specifically in the user.py controller handling user updates. No finer version details are provided beyond the 0.0.14 cutoff.", "description_and_impact": "The flaw resides in the update_user endpoint of SuperAGI's controller, where an attacker can manipulate the user_id parameter to bypass authorization checks, enabling unauthorized modification of any user account. This weakness aligns with CWE\u2011285 (Improper Authorization) and CWE\u2011639 (Authorization Bypass Through User\u2011Controlled Key).", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity, and while an EPSS value is absent, the publicly disclosed exploit demonstrates that remote attackers can trigger the bypass by crafting requests to the update_user endpoint with arbitrary user_id values. As the flaw is not listed in the CISA KEV catalog, it may have gone unnoticed in some environments, yet the public proof\u2011of\u2011concept shows that attackers can gain unauthorized control over user data."}}}}, "created": "2026-04-20T00:30:27.127319+00:00", "updated": "2026-04-20T01:00:08.944785+00:00", "vendors": ["superagi", "superagi$PRODUCT$superagi"]}