CVE-2024-10267 Information Disclosure in transformeroptimus/superagi
Attackers can leak sensitive user data like emails and passwords by registering with an existing email address in SuperAGI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-10267?
CVE-2024-10267 is a high-severity vulnerability in transformeroptimus/superagi, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionality.
Weakness: CWE-359
Which versions are affected by CVE-2024-10267?
It affects 1 product.
Products include Superagi Superagi.
How do I fix CVE-2024-10267?
No fix has been published for CVE-2024-10267 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-10267 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-10267 exists.
Other vulnerabilities in transformeroptimus/superagi
- CVE-2024-12048 IDOR Vulnerability in transformeroptimus/superagi
- CVE-2024-9415 Path Traversal in transformeroptimus/superagi
- CVE-2024-9439 Remote Code Execution in transformeroptimus/superagi
- CVE-2024-9437 Unauthenticated Denial of Service in transformeroptimus/superagi
- CVE-2023-48055 Hardcoded credentials in n/a
Sources
Also known as GHSA-8qff-6gwc-wph3.