PatchSiren cyber security CVE debrief

CVE-2026-30950 Significant-Gravitas CVE debrief

## Summary CVE-2026-30950 is a HIGH-severity (CVSS 7.1) authenticated session-hijacking vulnerability in AutoGPT, a workflow-automation platform for AI agents. Versions 0.6.36–0.6.50 are affected. An authenticated attacker who knows (or guesses) another user's session_id can reassign that session to themselves via the PATCH /sessions/{session_id}/assign-user endpoint. The flaw stems from an insecure direct object reference (IDOR): the service layer invokes the session lookup with user_id=None, which the data layer treats as a privileged/system call and therefore skips the ownership check. Consequences include unauthorized read access to session messages and denial of service for the legitimate user (session lock-out). ## Affected Products | Product | Versions | |---------|----------| | AutoGPT | 0.6.36 – 0.6.50 | ## Root Cause The PATCH /sessions/{session_id}/assign-user endpoint authenticates the caller but never verifies that the caller owns the target session. When the service layer queries the session, it passes user_id=None; the data-access layer interprets this as a system-level request and bypasses the ownership filter, allowing any authenticated user to reassign arbitrary sessions. ## Impact - **Confidentiality**: Attacker can read all messages in the hijacked session. - **Availability**: Legitimate user is locked out of their session. - **Scope**: Limited to session data; no indication of code execution or lateral movement. ## Exploitation Requirements - Valid user account on the target AutoGPT instance. - Ability to determine or guess a victim's session_id (e.g., via information disclosure, brute-force, or social engineering). ## Detection Guidance Monitor API logs for: - PATCH requests to /sessions/{session_id}/assign-user where the authenticated user_id differs from the session's original owner. - Rapid successive session assignment operations from a single source account. - Anomalous session access patterns (e.g., a user suddenly accessing sessions with unrelated content or historical messages predating their account creation). ## Mitigation 1. **Upgrade** to AutoGPT 0.6.51 or later, which patches the vulnerability. 2. **Validate** that