AGL app-framework-binder (afb-daemon) through version 19.90.0 contains a privilege escalation vulnerability in its supervision Do command. The vulnerability arises because the on_supervision_call function nullifies request credentials before dispatching API calls, allowing attacker-controlled API and verb parameters to execute with a NULL credential context. APIs relying on credentials for authorization may fail open, enabling privilege escalation. This flaw was introduced in February 2018 and has a high severity rating with a CVSS score of 7.8.