CVE-2026-51915

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller. In affected source snapshots, get_tool and update_tool in superagi/controllers/tool.py accept a caller-supplied tool_id and fail to verify organization ownership through the associated toolkit. A remote authenticated attacker from one organization can read or modify another organization's tool metadata through /tools/get/{tool_id} and /tools/update/{tool_id}.

• CWE-284

• https://gist.github.com/Ro1ME/f4a6cd6a48b7b904bd7bc4c6d710942f

Published

Oct 2, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-51906In TaskingAI v0.3.0 in the DALL-E 3 image generation tool sa…9.1
• CVE-2026-51907In TaskingAI v0.3.0 in the QR Code Generator plugin save_bas…8.1
• CVE-2026-5191The Tiled Gallery Carousel Without JetPack plugin for WordPr…5.4
• CVE-2026-51911vanna v2.0.2 contains a code injection vulnerability in Vann…9.8
• CVE-2026-51912OpenBMB XAgent v1.0.0 contains directory traversal vulnerabi…
• CVE-2026-51914TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorre…8.8
• CVE-2026-51916TransformerOptimus SuperAGI v0.0.14 contains an incorrect ac…7.5
• CVE-2026-51917FinRobot v1.0.0 is vulnerable to Code Injection in CodingUti…7.3
• CVE-2026-51918FinRobot 1.0.0 contains code injection in CodingUtils.create…9.8
• CVE-2026-5192The Forminator Forms – Contact Form, Payment Form & Custom F…7.5
• CVE-2026-51922agentscope v1.0.20 contains code injection in execute_shell_…9.8
• CVE-2026-51923An Insecure Direct Object Reference (IDOR) vulnerability exi…8.1