CVE-2025-53944

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents. In v0.6.15 and below, the external API's get_graph_execution_results endpoint has an authorization bypass vulnerability. While it correctly validates user access to the graph_id, it fails to verify ownership of the graph_exec_id parameter, allowing authenticated users to access any execution results by providing arbitrary execution IDs. The internal API implements proper validation for both parameters. This is fixed in v0.6.16.

• CWE-285
• CWE-639

• https://github.com/Significant-Gravitas/AutoGPT/commit/309114a727baa2063357810d444e9a119f8dd7f6Patch
• https://github.com/Significant-Gravitas/AutoGPT/releases/tag/autogpt-platform-beta-v0.6.16Release Notes
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-x77j-qg2x-fgg6Exploit, Vendor Advisory
• https://github.com/Significant-Gravitas/AutoGPT/security/advisories/GHSA-x77j-qg2x-fgg6Exploit, Vendor Advisory

Published

Jul 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-53939Kiteworks is a private data network (PDN). Prior to version …8.8
• CVE-2025-5394The Alone – Charity Multipurpose Non-profit WordPress Theme …9.8
• CVE-2025-53940Quiet is an alternative to team chat apps like Slack, Discor…8.5
• CVE-2025-53941Hollo is a federated single-user microblogging software desi…6.1
• CVE-2025-53942authentik is an open-source Identity Provider that emphasize…7.4
• CVE-2025-53943VoidBot Open-Source is a customizable Discord bot. VoidBot O…8.7
• CVE-2025-53945apko allows users to build and publish OCI container images …7
• CVE-2025-53946WeGIA is an open source web manager with a focus on the Port…8.8
• CVE-2025-53947A local attacker with low privileges on the Windows system w…7.7
• CVE-2025-53948The Sante PACS Server allows a remote attacker to crash the …8.7
• CVE-2025-53949An Improper Neutralization of Special Elements used in an OS…8.8
• CVE-2025-5395The WordPress Automatic Plugin plugin for WordPress is vulne…8.8