Executive brief
Aegra, a self-hosted AI agent backend, is vulnerable to an authorization flaw where one authenticated user can access and manipulate the conversation threads of another. An attacker can execute AI workflows on behalf of other users, read their private conversation history, and inject unauthorized messages into their sessions. This could lead to significant data exposure and the corruption of AI-driven business processes in shared environments.
Technical details
Aegra 0.9.0 through 0.9.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in its run-creation endpoints. While read endpoints implemented SQL-level user filtering, the endpoints `POST /threads/{thread_id}/runs`, `/runs/stream`, and `/runs/wait` lacked these checks, relying on a default-allow authorization model when custom handlers were absent. An authenticated attacker with knowledge of a victim's UUID-based `thread_id` (which may leak via logs or URLs) can trigger graph executions, retrieve the full checkpoint state (including message history), and persist arbitrary messages into the victim's thread. The vulnerability is fixed in version 0.9.7 by enforcing ownership checks at the SQL layer.
Affected products
- Aegra aegra-api >= 0.9.0, < 0.9.7
Timeline
- 2026-04-30: disclosed: Vulnerability reported by researcher
- 2026-04-30: patched: Fix committed to repository
- 2026-05-07: advisory: GitHub Advisory published
- 2026-05-14: other: NVD publication and CVSS assignment