High, CVSS 8.6PyPIAmendedPublished
Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)
CVE-2026-44504 · GHSA-m98r-6667-4wq7
- Affected
- PyPI aegra-api >= 0.9.0, < 0.9.7
- Fixed in
- 0.9.7· Vendor fix available
- Issue
- Impact Aegra deployments running 0.9.0 through 0.9.6 with multiple authenticated users on a shared instance are vulnerable to a cross-tenant IDOR. Any authenticated user (User A), given another user's threadid (User B), can: - Execute graph runs against User B's thread via POST /threads/{threadid}/runs, POST /threads/{threadid}/runs/stream, or POST /threads/{threadid}/runs/wait - Read User B's full checkpoint state via the resulting run's output field - Inject arbitrary messages into User B's conversation history (persisted in B's checkpoint) - Hide their activity from User B's GET /threads/{threadid}/runs listing because the run carries A's userid The streaming variant is worse — the first SSE event: values frame returns the entire prior messages array immediately on connection, no graph execution needed. Thread IDs are UUIDs but leak through frontend URLs, server logs, observability traces, and shared links. Guessing is not required. Patches Fixed in 0.9.7. The three affected…
Recommended action: Upgrade to 0.9.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.