CVE-2026-51867
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Risk Assessment
Risk of unauthorized access to other users' or tenants' data, potentially leading to data confidentiality breach.
Recommendation
Update agentgpt to the latest version or implement proper access controls in agentRouter.ts.
Other vulnerabilities in agentgpt
Original NVD description (English source)
agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS