This vulnerability affects the TransformerOptimus SuperAGI product up to version 0.0.14. It is located in the update_organisation function within the superagi/controllers/organisation.py file. By manipulating the organisation_id parameter, an attacker can bypass authorization controls, potentially allowing unauthorized updates to organisation data. The issue is remotely exploitable and has been publicly disclosed. No vendor response or patch has been provided as of the publication date.

Successful exploitation allows an attacker with limited privileges to bypass authorization checks and update organisation information without proper permissions. This could lead to unauthorized modification of organisation data within the affected application. The CVSS score of 5.3 reflects a medium impact, with network attack vector and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the update_organisation endpoint and monitor for suspicious activity related to organisation updates. Implementing additional access controls or compensating controls may help reduce risk until an official patch is released.