CVE-2026-30950 AutoGPT has Authenticated Session Hijacking via IDOR
Authenticated attackers can hijack other users' sessions by exploiting an IDOR flaw in the session assignment endpoint, allowing them to read messages and lock out legitimate users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-30950?
CVE-2026-30950 is a high-severity missing authorization vulnerability in Significant-Gravitas AutoGPT, published on 18 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Versions 0.6.36 through 0.6.50 are vulnerable to Authenticated Session Hijacking via IDOR. If an authenticated attacker can determine the session_id of another user's session, they can take it over, reading any messages in it and locking the legitimate user out. The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies session ownership: the service layer invokes the session lookup with user_id=None, which the data access layer interprets as a privileged/system call that bypasses the ownership filter, allowing any authenticated user to reassign an arbitrary session to themselves. This issue has been patched in version 0.6.51.
Weakness: CWE-862
Which versions are affected by CVE-2026-30950?
How do I fix CVE-2026-30950?
No fix has been published for CVE-2026-30950 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-30950 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30950 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-q58p-v9r9-7gqj.