Executive brief
AutoGPT is an automation platform used to create and manage AI agents. A security flaw in the platform's webhook system allows any logged-in user to access information about other users' webhooks. An attacker could use this to confirm the existence of specific webhooks, identify which third-party services (like GitHub) a user has connected, and potentially trigger unauthorized automated actions on behalf of other users.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `POST /api/integrations/webhooks/{webhook_id}/ping` endpoint within `autogpt_platform/backend/backend/api/features/integrations/router.py`. The `webhook_ping` function calls `get_webhook(webhook_id)` without verifying that the `user_id` of the authenticated requester matches the `user_id` associated with the webhook. An authenticated attacker can provide an arbitrary UUID to the endpoint; a successful response (200) or specific error (500) confirms the webhook's existence and can leak the OAuth provider type (e.g., GitHub vs others) based on the error message returned. In some configurations, this also allows the attacker to trigger a ping delivery for a victim's webhook. The issue is resolved in version 0.6.64 by implementing proper ownership validation.
Affected products
- Significant-Gravitas AutoGPT < 0.6.64
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory
- 2026-06-26: patched: Fixed in version 0.6.64