The vulnerability is an authorization bypass in the SuperAGI controller functions get_project, update_project, and get_projects_organisation, allowing unauthenticated or improperly authorized users to view or modify any project. The flaw is caused by insufficient verification of user permissions, as indicated by CWE-285 and CWE-639. Attackers can retrieve or change project data without following the intended access controls, potentially exposing confidential project information and enabling further malicious actions.

Affected by this flaw are installations of TransformerOptimus SuperAGI up to version 0.0.14. Any deployment that has not upgraded beyond this version and that exposes the /project endpoints can be impacted. The vulnerability exists in the superagi/controllers/project.py module.

The CVSS score of 5.3 reflects medium severity. EPSS is not available, so the exact likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog, but the public release of the exploit suggests that attackers can target affected systems remotely. Because the flaw bypasses authorization checks, it can be exploited with only network access to the API and minimal credentials, making it a significant risk for any organization running the vulnerable version.