This vulnerability affects the TransformerOptimus SuperAGI product up to version 0.0.14. It arises from improper authorization checks in the update_organisation function of the superagi/controllers/organisation.py file. By manipulating the organisation_id parameter, an attacker can bypass authorization controls remotely, potentially allowing unauthorized updates to organisation data. The issue has been publicly disclosed, but the vendor has not provided a fix or advisory. No known exploits in the wild have been reported as of the publication date.

Successful exploitation allows an attacker with limited privileges to bypass authorization controls and update organisation information without proper permission. This could lead to unauthorized modification of organisation data within the affected SuperAGI deployments. The impact is limited to the scope of the organisation update functionality and requires remote access. The medium CVSS score reflects the moderate risk posed by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoint and monitor for suspicious activity related to organisation updates. Implementing additional access controls or compensating controls may help reduce risk until a patch is released.