CVE-2026-51902
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
SuperAGI 版本 0.0.14 及以下存在访问控制不当的漏洞。代理控制器端点 允许来自一个组织的已认证用户，检索属于另一个组织项目的完整代理列表。该端点接受 参数，但未验证该项目是否属于已认证用户所在的组织。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-51902
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id} allows authenticated users from one organization to retrieve the complete list of agents belonging to a different organization's project. The endpoint accepts a project_id parameter but does not verify that the project belongs to the authenticated user's organization.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-51902
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-51902
请登录查看更多情报信息。
Other References for CVE-2026-51902 (2)
Same Patch Batch · n/a · 2026-10-29 · 53 CVEs total
| CVE-2026-107049 | Forkyz 8500000 任意修改存储设置漏洞 | |
| CVE-2026-51831 | IDrive Backup 7.0.1.1 及以下版本本地任意代码执行漏洞 | |
| CVE-2026-51832 | IDrive Backup 7.0.1.1 及以下版本任意代码执行漏洞 | |
| CVE-2026-51851 | ModelScope Agent-Zero 1.7-1.10 目录穿越漏洞 | |
| CVE-2026-51905 | SuperAGI v0.0.14 越权读取代理配置漏洞 | |
| CVE-2026-51912 | OpenBMB XAgent v1.0.0 目录穿越漏洞 | |
| CVE-2026-51863 | DB-GPT 0.7.5/0.8.0 目录穿越漏洞 | |
| CVE-2026-51903 | SuperAGI v0.0.14 存在越权访问漏洞 | |
| CVE-2026-107059 | Nextcloud 30390190 认证绕过漏洞 | |
| CVE-2026-107055 | AppML neutriNote CE 1387 自动保存组件权限漏洞 | |
| CVE-2026-107057 | AndBible 1111 任意代码执行漏洞 | |
| CVE-2026-107051 | AndFHEM v2.4.1 权限漏洞致配置被篡改 | |
| CVE-2026-107050 | RetroArch 1.22.2 任意代码执行漏洞 | |
| CVE-2026-107048 | MotionCreative Motion UI 101 WebView 远程代码执行漏洞 | |
| CVE-2026-107044 | ProjectMAXS v0.5.19 权限配置不当漏洞 | |
| CVE-2026-107043 | Code Catcher 131 短信捕获机制权限配置漏洞 | |
| CVE-2026-107046 | FocusPodcast 70 组件 SSRF 漏洞可扫描内网 | |
| CVE-2026-107047 | GPSLogger 137 版本权限配置不当致日志被篡改 | |
| CVE-2026-107045 | Citrine v3.1.0 CitrineContentProvider 组件权限漏洞 | |
| CVE-2026-107042 | USP Ultimate Screenshot Painter 240213.009 文件覆盖漏洞 |
Showing top 20 of 53 CVEs. View all on vendor page → →