Summary
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control issue in the agent template controller. An authenticated user may be able to reference another organization's agent or execution when saving or publishing a template if caller-supplied identifiers are not checked against the user's organization.
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control issue in the agent template controller. An authenticated user may be able to reference another organization's agent or execution when saving or publishing a template if caller-supplied identifiers are not checked against the user's organization.
Affected context
The issue occurs in deployments using the affected agent template controller and its
save_agent_as_template or publish_template operations. Risk is present when these
operations accept user-controlled agent_id or agent_execution_id values without
verifying ownership or organizational authorization for the referenced resources.
The issue occurs in deployments using the affected agent template controller and its
save_agent_as_template or publish_template operations. Risk is present when these
operations accept user-controlled agent_id or agent_execution_id values without
verifying ownership or organizational authorization for the referenced resources.
Exploit preconditions
- Attack surface: Authenticated agent template management endpoints
- Required access: A valid user account capable of invoking the affected controller operations
- Trigger point: Supplying an agent or execution identifier to template save or publish functionality
- Why exploitation is possible: The controller may rely on caller-provided identifiers without confirming that the referenced resources belong to the authenticated user's organization
- Attack surface: Authenticated agent template management endpoints
- Required access: A valid user account capable of invoking the affected controller operations
- Trigger point: Supplying an agent or execution identifier to template save or publish functionality
- Why exploitation is possible: The controller may rely on caller-provided identifiers without confirming that the referenced resources belong to the authenticated user's organization
Why this happens
The underlying flaw is an authorization failure caused by missing object-level access checks.
The controller accepts resource identifiers from the caller but does not consistently enforce
an organization-ownership relationship between the authenticated principal and the referenced
agent or execution. This behavior maps to CWE-284: Improper Access Control, because
authorization decisions can be bypassed when resource ownership is not validated at the
operation boundary.
The underlying flaw is an authorization failure caused by missing object-level access checks.
The controller accepts resource identifiers from the caller but does not consistently enforce
an organization-ownership relationship between the authenticated principal and the referenced
agent or execution. This behavior maps to CWE-284: Improper Access Control, because
authorization decisions can be bypassed when resource ownership is not validated at the
operation boundary.
Potential impact
- An authenticated user may access information associated with another organization
- A user could create templates from unauthorized agents or executions
- Unauthorized users may publish or alter templates derived from protected resources
- Cross-tenant data exposure or workflow manipulation could occur
- The issue could weaken isolation between organizations
- An authenticated user may access information associated with another organization
- A user could create templates from unauthorized agents or executions
- Unauthorized users may publish or alter templates derived from protected resources
- Cross-tenant data exposure or workflow manipulation could occur
- The issue could weaken isolation between organizations
General mitigation guidance
Mitigation generally focuses on enforcing authorization at every resource access boundary.
Common defensive patterns include:
- Deriving organization or tenant context from the authenticated session rather than request data
- Verifying ownership or permitted organizational scope for every referenced agent and execution
- Applying centralized, deny-by-default object-level authorization checks
- Avoiding trust in caller-supplied identifiers for authorization decisions
- Returning consistent authorization failures without disclosing whether unauthorized resources exist
- Running integration tests that cover cross-organization access attempts
These controls should apply equally to read, save, publish, update, and related template operations.
Mitigation generally focuses on enforcing authorization at every resource access boundary.
Common defensive patterns include:
- Deriving organization or tenant context from the authenticated session rather than request data
- Verifying ownership or permitted organizational scope for every referenced agent and execution
- Applying centralized, deny-by-default object-level authorization checks
- Avoiding trust in caller-supplied identifiers for authorization decisions
- Returning consistent authorization failures without disclosing whether unauthorized resources exist
- Running integration tests that cover cross-organization access attempts
These controls should apply equally to read, save, publish, update, and related template operations.
How teams detect issues like this
Detection approaches may include:
- Static analysis and code review checks for controller methods that use request-provided object identifiers without authorization calls
- Reviewing whether every agent and execution lookup is followed by organization or tenant-scope validation
- Testing authenticated operations with resources belonging to separate organizations
- Monitoring authorization-denied events and unusual cross-tenant identifier access patterns
- Enforcing policy rules that require centralized authorization middleware or service-layer checks for protected resources
Automated code review tools can help identify direct identifier-to-object flows that lack visible ownership validation.
Detection approaches may include:
- Static analysis and code review checks for controller methods that use request-provided object identifiers without authorization calls
- Reviewing whether every agent and execution lookup is followed by organization or tenant-scope validation
- Testing authenticated operations with resources belonging to separate organizations
- Monitoring authorization-denied events and unusual cross-tenant identifier access patterns
- Enforcing policy rules that require centralized authorization middleware or service-layer checks for protected resources
Automated code review tools can help identify direct identifier-to-object flows that lack visible ownership validation.
Sources
| Source | Link |
|---|---|
| gist. | gist.github.com/ |
