AgentGPT v1.0.0 contains an incorrect access control flaw in the agent router implementation. The endpoint accepts an external object or tenant identifier and performs a data-access operation without binding the request to an owner, tenant, workspace, or membership context. As a result, an attacker can retrieve or manipulate data they should not have permission to access.

The vulnerability affects the open-source AgentGPT project, specifically version 1.0.0, through the next/src/server/api/routers/agentRouter.ts code path. No vendor or proprietary product information is provided, but the flaw is present in the foreground code of this community-maintained application.

The CVSS score is 9.8, indicating a high severity vulnerability. The EPSS score is < 1%, indicating a low exploitation probability. The flaw is externally reachable and does not require elevated privileges, indicating a high potential impact if exploited. The absence of an official KEV listing suggests that active exploitation is not documented, but the lack of access controls presents a clear security gap that an attacker could exploit by supplying crafted identifiers to the exposed API endpoint.