The vulnerability exists in SuperAGI’s API Key Management Endpoint, specifically the delete_api_key and edit_api_key functions. It permits attackers to bypass authorization controls, allowing them to delete or modify API keys without the required privileges. Remote access to these endpoints provides an opportunity for an attacker to alter key settings or create unauthorized keys, compromising system integrity and exposing services to abuse.

TransformerOptimus SuperAGI versions up to and including 0.0.14 are affected. The flaw targets the API Key Management component located in superagi/controllers/api_key.py. Any installation of SuperAGI that exposes these endpoints to external networks is susceptible, regardless of operating platform.

The CVSS base score is 5.3, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, meaning no current evidence of active exploitation. Nonetheless, because the issue is remotely exploitable and publicly disclosed, attackers with network reach could potentially gain unauthorized API key control. The lack of KEV status does not eliminate future exploitation risk, particularly given the straightforward authorization bypass.