This vulnerability in TransformerOptimus SuperAGI (up to version 0.0.14) allows an attacker to bypass authorization checks when invoking the delete_api_key and edit_api_key functions in the superagi/controllers/api_key.py component. The flaw enables remote exploitation without user interaction and requires low privileges. The vendor has not issued any patch or official remediation, and no known exploits are reported in the wild as of the publication date.

Successful exploitation permits unauthorized users to manipulate API keys by deleting or editing them without proper authorization. This could lead to unauthorized access or disruption of API key management, potentially compromising system integrity or availability. However, the impact is limited by the requirement of low privileges and the absence of known active exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider restricting access to the affected API endpoints and monitor for suspicious activity related to API key management. Implementing additional access controls or compensating controls may reduce risk until an official patch is available.