CVE-2024-10267 json
Information Disclosure in transformeroptimus/superagi
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7111
- cvss
- 7.5
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including names, emails, and passwords, by attempting to register a new account with an email that is already in use. The server returns all information associated with the existing account. The vulnerable endpoint is located in the user registration functionality.
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/13da8366-4670-4d46-9f5a-ba3f642b692e referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected products
- transformeroptimus transformeroptimus/superagi
Classification
- Weakness
-
- CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
References
-
huntr.com
/bounties/13da8366-4670-4d46-9f5a-ba3f642b692e
exploit, third-party-advisory
Sources
- CVE List CVE-2024-10267
- NVD CVE-2024-10267
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.