SuperAGI versions up to 0.0.14 have an improper access control vulnerability in the agent controller endpoint /api/agents/get/project/{project_id}. This flaw allows authenticated users from one organization to access the full list of agents belonging to projects of other organizations, due to lack of verification that the project_id belongs to the user's organization. The issue is fixed in version 0.0.15.