This vulnerability in TransformerOptimus SuperAGI (up to version 0.0.14) allows an attacker to bypass authorization controls by manipulating the user_id parameter in the update_user function located in superagi/controllers/user.py. This flaw enables unauthorized remote attackers to potentially update user information without proper permissions. The issue has been publicly disclosed, but the vendor has not provided a fix or guidance. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to update user data without authorization, potentially leading to unauthorized changes in user accounts. The impact is rated medium based on the CVSS score of 5.3. There is no evidence of active exploitation in the wild at this time.

No official patch or remediation is currently available from the vendor, and the vendor has not responded to the disclosure. Users should monitor official channels for updates. Until a fix is released, consider implementing additional access controls or network-level restrictions to limit exposure of the affected endpoint. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.