{"data":{"id":"19e2f489-8dd8-4be8-b667-208d3762d596","title":"CVE-2026-54519: AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior…","summary":"AI Agent Automation versions prior to 0.9.1 contain an authorization flaw in backend/src/controllers/memory.controller.js. The listMemories, deleteMemory, and clearAgentMemory functions accept a caller-supplied agentId or memory _id without checking that the related Agent belongs to req.user. An authenticated attacker who knows or obtains another user's identifiers can read that user's AgentMemory content, delete an individual memory, or clear all memory for a victim agent.","solution":"Fixed in 0.9.1.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54519","publishedAt":"2026-09-17T22:17:00.930Z","cveId":"CVE-2026-54519","cweIds":["CWE-862"],"cvssScore":"8.8","cvssSeverity":"high","severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AI Agent Automation"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AI Agent Automation memory controller lacks ownership checks","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"none","exploitMaturity":"unknown","epssScore":0.00515,"epssCheckedAt":"2026-11-04T18:09:14.608Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-01T00:10:42.645Z","patchAvailable":null,"disclosureDate":"2026-09-17T22:17:00.930Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-122"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}