This vulnerability affects TransformerOptimus SuperAGI versions 0.0.1 through 0.0.14 in the Budget Endpoint's get_budget and update_budget functions. It allows an attacker to bypass authorization controls remotely, potentially manipulating budget-related data without proper permissions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low to low impact on confidentiality, integrity, and availability. The vendor has not issued a fix or advisory, and no patch links are available.

Successful exploitation enables unauthorized remote actors to bypass authorization checks on budget management functions, potentially leading to unauthorized budget data access or modification. The impact is rated medium with limited confidentiality, integrity, and availability effects. There are no confirmed reports of exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider restricting access to the affected endpoints and monitor for suspicious activity related to budget operations. Avoid exposing the Budget Endpoint to untrusted networks until a fix is released.