This vulnerability in TransformerOptimus SuperAGI (up to version 0.0.14) involves improper authorization checks in the update_user function located in superagi/controllers/user.py. By manipulating the user_id parameter, an attacker can bypass authorization mechanisms remotely, potentially allowing unauthorized modification of user data. The vulnerability has been publicly disclosed, but the vendor has not issued any advisory or patch. The CVSS 4.0 score is 5.3, indicating a medium severity risk.

Successful exploitation allows an attacker with low privileges to bypass authorization controls on the user update endpoint, potentially modifying user information without proper permissions. This could lead to unauthorized changes to user accounts or data integrity issues. There is no indication of direct system compromise or data confidentiality loss from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix or workaround is available, users should restrict access to the update_user endpoint to trusted parties only and monitor for suspicious activity related to user modifications. Avoid exposing this endpoint publicly until a patch or official mitigation is released.