Summary
SuperAGI v0.0.14 contains an access-control weakness in tool management operations that may let an authenticated user access or alter tool metadata belonging to another organization. The issue becomes risky when caller- supplied tool identifiers are processed without verifying ownership through the associated toolkit.
SuperAGI v0.0.14 contains an access-control weakness in tool management operations that may let an authenticated user access or alter tool metadata belonging to another organization. The issue becomes risky when caller- supplied tool identifiers are processed without verifying ownership through the associated toolkit.
Affected context
The vulnerability occurs in the SuperAGI tool controller, specifically in the get_tool and update_tool operations exposed through tool-management endpoints. Deployments are affected when these operations accept a tool_id from an authenticated request but do not confirm that the referenced tool belongs to the caller's organization through its associated toolkit.
The vulnerability occurs in the SuperAGI tool controller, specifically in the get_tool and update_tool operations exposed through tool-management endpoints. Deployments are affected when these operations accept a tool_id from an authenticated request but do not confirm that the referenced tool belongs to the caller's organization through its associated toolkit.
Exploit preconditions
- Attack surface: Remote tool-management API - Required access: An authenticated account in a SuperAGI organization - Trigger point: Requests that retrieve or update a tool by caller-supplied
identifier
- Why exploitation is possible: Resource authorization does not consistently
bind the requested tool and toolkit to the requesting organization
- Attack surface: Remote tool-management API - Required access: An authenticated account in a SuperAGI organization - Trigger point: Requests that retrieve or update a tool by caller-supplied
identifier
- Why exploitation is possible: Resource authorization does not consistently
bind the requested tool and toolkit to the requesting organization
Why this happens
The underlying bug is an object-level authorization failure. The controller trusts a caller-supplied tool identifier and performs retrieval or update actions without enforcing an organization-ownership check through the related toolkit. This behavior maps to CWE-284, where access to a protected resource is not adequately restricted according to the caller's authority.
The underlying bug is an object-level authorization failure. The controller trusts a caller-supplied tool identifier and performs retrieval or update actions without enforcing an organization-ownership check through the related toolkit. This behavior maps to CWE-284, where access to a protected resource is not adequately restricted according to the caller's authority.
Potential impact
- An authenticated user may read tool metadata owned by another organization.
- An attacker could modify another organization's tool metadata.
- Cross-tenant confidentiality and integrity could be compromised.
- Unauthorized changes may disrupt workflows or support further abuse of trusted tool configurations.
- An authenticated user may read tool metadata owned by another organization.
- An attacker could modify another organization's tool metadata.
- Cross-tenant confidentiality and integrity could be compromised.
- Unauthorized changes may disrupt workflows or support further abuse of trusted tool configurations.
General mitigation guidance
Mitigation generally focuses on centralized, deny-by-default authorization for every object-level operation. Resource lookups and updates should derive organizational scope from the authenticated session and verify ownership through the complete relationship chain before returning or changing data. Secure-by-default patterns include policy checks shared across endpoints, opaque handling of unauthorized versus nonexistent resources, immutable tenant boundaries, and least-privilege service identities. Input trust can be reduced by avoiding authorization decisions based solely on client- supplied identifiers and by enforcing organization scoping at the data access layer.
Mitigation generally focuses on centralized, deny-by-default authorization for every object-level operation. Resource lookups and updates should derive organizational scope from the authenticated session and verify ownership through the complete relationship chain before returning or changing data. Secure-by-default patterns include policy checks shared across endpoints, opaque handling of unauthorized versus nonexistent resources, immutable tenant boundaries, and least-privilege service identities. Input trust can be reduced by avoiding authorization decisions based solely on client- supplied identifiers and by enforcing organization scoping at the data access layer.
How teams detect issues like this
Detection can include static and semantic analysis for controller methods that use request-provided identifiers without nearby authorization checks. Code reviews should look for direct object retrieval or mutation before tenant or organization validation, inconsistent checks between read and update paths, and authorization logic duplicated across endpoints. Runtime monitoring can flag cross-organization resource references, denied access spikes, and metadata updates that fall outside normal tenant scope. Policy enforcement in CI and automated review tools can help require centralized authorization for object-level API operations.
Detection can include static and semantic analysis for controller methods that use request-provided identifiers without nearby authorization checks. Code reviews should look for direct object retrieval or mutation before tenant or organization validation, inconsistent checks between read and update paths, and authorization logic duplicated across endpoints. Runtime monitoring can flag cross-organization resource references, denied access spikes, and metadata updates that fall outside normal tenant scope. Policy enforcement in CI and automated review tools can help require centralized authorization for object-level API operations.
Sources
| Source | Link |
|---|---|
| gist. | gist.github.com/ |
