Summary
SuperAGI contains an access control flaw in the knowledge-deletion endpoint, allowing a request to delete a knowledge object without authentication or organization-ownership checks. An attacker who can reach the endpoint and obtain a valid knowledge identifier may delete data belonging to another organization.
Affected context
The issue occurs in deployments using the affected SuperAGI knowledge-management route. The deletion handler may process a supplied knowledge identifier without first establishing the caller's identity or confirming that the selected object belongs to the caller's organization.
Exploit preconditions
- Attack surface: HTTP POST request to the knowledge-deletion endpoint
- Required access: Network reachability to the application; authentication may not be required by the affected route
- Trigger point: Submission of a deletion request containing a knowledge identifier
- Why exploitation is possible: The route lacks required authentication and organization-ownership checks before deleting the referenced object
Why this happens
The vulnerability results from enforcing neither authentication nor object-level authorization at a sensitive deletion operation. This is an instance of CWE-284: Improper Access Control, where application logic permits a request to perform a protected action without verifying that the requester has the necessary identity and ownership privileges.
Potential impact
- An unauthenticated or unauthorized party may delete knowledge objects
- Organizations could experience loss of stored knowledge and related functionality
- Attackers could cause integrity or availability impacts through repeated deletion requests
- Operational recovery costs could increase if deleted data is not backed up
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the operation that performs the deletion, rather than relying only on route exposure or client-side controls.
Common defensive patterns include:
- Require authentication before processing knowledge-management actions
- Verify that the authenticated principal has permission to delete the requested object
- Enforce organization or tenant ownership checks using server-side data
- Use deny-by-default authorization policies for destructive operations
- Return consistent authorization failures without revealing unnecessary object details
- Apply least privilege and maintain recoverable backups for important knowledge data
How teams detect issues like this
Organizations can look for this weakness through:
- Static analysis rules identifying destructive handlers without nearby authorization checks
- Code review signals such as direct deletion by client-supplied identifiers
- Tests that attempt cross-organization object access and unauthenticated requests
- API policy checks requiring authentication and object-level authorization for destructive methods
- Audit-log monitoring for unusual deletion volume, anonymous requests, or cross-tenant access attempts
Automated security review tools may help identify missing access-control checks, but behavioral authorization tests should also be used.
