This vulnerability in TransformerOptimus SuperAGI (up to version 0.0.14) involves an authorization bypass in the functions get_project, update_project, and get_projects_organisation within superagi/controllers/project.py. An attacker can remotely manipulate these functions to bypass authorization checks, potentially gaining unauthorized access to project-related data or functionality. The vulnerability is publicly known, and exploit code has been released. No vendor response or patch has been documented, and the product is not a cloud service, so remediation depends on vendor action or community fixes.

Successful exploitation allows remote attackers with limited privileges to bypass authorization controls on project-related functions, potentially leading to unauthorized access or modification of project data. The medium CVSS score (5.3) reflects a moderate impact with low attack complexity and no user interaction required. There are no confirmed reports of exploitation in the wild yet, but public exploit availability increases risk.

No official patch or remediation is currently available, and the vendor has not responded to disclosure attempts. Users should monitor the vendor's channels for any future updates or patches. Until a fix is released, restricting access to affected functions and implementing additional access controls at the network or application level may help reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.