This vulnerability in TransformerOptimus SuperAGI (<= 0.0.14) allows remote attackers to bypass authorization checks by manipulating the agent_id parameter in specific controller functions (delete_agent, stop_schedule, get_schedule_data). This could enable unauthorized access or actions related to agent management and scheduling within the application. The vendor has not provided a patch or remediation guidance, and the exploit is publicly accessible.

Successful exploitation allows an attacker with network access and low privileges to bypass authorization controls, potentially enabling unauthorized deletion of agents, stopping schedules, or retrieving schedule data. This could lead to unauthorized manipulation or disclosure of scheduling and agent-related information within the affected application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing additional access controls or network restrictions to limit exposure to the affected functions until a patch is released.