The flaw resides in the update_user endpoint of SuperAGI's controller, where an attacker can manipulate the user_id parameter to bypass authorization checks, enabling unauthorized modification of any user account. This weakness aligns with CWE‑285 (Improper Authorization) and CWE‑639 (Authorization Bypass Through User‑Controlled Key).

TransformerOptimus SuperAGI versions up to 0.0.14 are affected. The issue occurs within the SuperAGI application, specifically in the user.py controller handling user updates. No finer version details are provided beyond the 0.0.14 cutoff.

The CVSS score of 5.3 indicates medium severity, and while an EPSS value is absent, the publicly disclosed exploit demonstrates that remote attackers can trigger the bypass by crafting requests to the update_user endpoint with arbitrary user_id values. As the flaw is not listed in the CISA KEV catalog, it may have gone unnoticed in some environments, yet the public proof‑of‑concept shows that attackers can gain unauthorized control over user data.