Executive brief
AutoGPT is a platform used to create and manage autonomous AI agents. A security flaw allows any logged-in user to take over the chat sessions of other users if they know the session ID. This allows an attacker to read private messages and lock the original owner out of their own session, potentially exposing sensitive data or disrupting AI workflows.
Technical details
The vulnerability exists in the `PATCH /sessions/{session_id}/assign-user` endpoint of the AutoGPT platform backend. While the endpoint requires a valid JWT for authentication, it fails to verify if the caller has ownership of the session being modified. The service layer calls `get_chat_session(session_id, None)`, passing `None` as the `user_id`. The data access layer interprets a `None` value as a privileged system call, bypassing the ownership filter that would normally compare the session's owner to the requester's ID. An authenticated attacker who discovers a victim's UUID-based session ID can reassign that session to their own account, poisoning the Redis cache and gaining full access to the session history. This has been patched in version 0.6.51.
Affected products
- Significant-Gravitas AutoGPT Platform Backend 0.6.36 - 0.6.50
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-18: disclosed: CVE published to NVD