SuperAGI versions up to v0.0.14 allow users to create or start agent execution records by providing an agent_id that is not validated against the authenticated user's organization. A remotely authenticated attacker can therefore create new executions or start existing ones that belong to another organization. This grants the attacker unauthorized jurisdiction over agent workloads and can expose sensitive data or consume resources that the attacker does not own.

SuperAGI, specifically the agent execution controller in the source code referenced by superagi/controllers/agent_execution.py, up to version v0.0.14.

The vulnerability requires authentication and access to the API endpoints /agentexecutions/add and /agentexecutions/add_run. EPSS score is < 1% and the issue is not yet listed in the CISA KEV catalog. The CVSS score is 9.8, indicating critical severity. Nonetheless, the potential for cross-organization privilege escalation is significant, as any legitimate user from one organization can manipulate agents owned by another organization without restrictions. Attackers could trigger computational tasks, seed data exfiltration, or drain shared resources.