CVE-2024-9447

Description

An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. The `/get/organisation/` endpoint does not verify the user's organization, allowing any authenticated user to retrieve sensitive configuration details, including API keys, of any organization. This could lead to unauthorized access to services and significant data breaches or financial loss.

Reserved 2024-10-02 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-1230 Exposure of Sensitive Information Through Metadata

Product status

Any version
affected

References

huntr.com/bounties/c952ea32-3047-42d3-8a3e-e67899e35dfd

cve.org (CVE-2024-9447)

nvd.nist.gov (CVE-2024-9447)

Download JSON