CVE-2026-51867

Received Received - Intake

Incorrect Access Control in AgentGPT Next.js API

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: MITRE

Description

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally reachable path accepts a caller-selected object or tenant identifier and reaches a data-access operation without a visible owner, tenant, workspace, or membership binding on that object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-51867

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in agentgpt v1.0.0 allows unauthorized access to data due to incorrect access control. An exposed API endpoint accepts a user-provided identifier but does not verify ownership or membership, enabling attackers to access sensitive data without proper authorization.

Impact Analysis

If you use agentgpt v1.0.0, attackers could exploit this flaw to access private data, such as agent configurations or workspace information, without permission. This could lead to data breaches, unauthorized modifications, or exposure of sensitive details.

Compliance Impact

This vulnerability likely violates compliance requirements like GDPR and HIPAA, which mandate strict access controls and data protection. Unauthorized access risks exposing personal or health data, leading to legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately review and restrict access to the vulnerable path in next/src/server/api/routers/agentRouter.ts. Ensure all data-access operations include proper owner, tenant, workspace, or membership binding checks.

Hi! I’m here to help you understand CVE-2026-51867. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70