Home » Database

AVID-2026-R1635

Description

Improper Privilege Management in transformeroptimus/superagi (CVE-2024-9431)

Details

In version v0.0.14 of transformeroptimus/superagi, there is an improper privilege management vulnerability. After logging into the system, users can change the passwords of other users, leading to potential account takeover.

Reason for inclusion in AVID: CVE-2024-9431 describes an improper privilege management vulnerability in transformeroptimus/superagi that allows an authenticated user to change other users' passwords, enabling account takeover. This is a software vulnerability in a component (AI orchestration/management platform) used to build and run AI systems, i.e., part of the AI supply chain. The issue concerns software security (privilege escalation/integrity) with clear evidence in the CVE entry and references.

References

Affected or Relevant Artifacts

  • Developer: transformeroptimus
  • Deployer: transformeroptimus
  • Artifact Details:
TypeName
Systemtransformeroptimus/superagi

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score6.5
Base Severity🟠 Medium
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges Required🟢 Low
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity Impact🔴 High
Availability ImpactNONE

CWE

IDDescription
CWE-620CWE-620 Unverified Password Change

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry