chaitanyagarware/cve-2026-54519Public advisory landing page for CVE-2026-54519: missing ownership checks in ai-agent-automation memory APIs enabling cross-user memory read and deletion. Links to GHSA, CVE.org, NVD, and OSV records.
ai-agent-automation missing ownership checks in memory APIs allowed cross-user memory read and deletion.
Primary advisory: GHSA-qv97-83w4-ff86
Researcher credit: @chaitanyagarware
| Field | Value |
|---|---|
| CVE | CVE-2026-54519 |
| GHSA | GHSA-qv97-83w4-ff86 |
| Project | vmDeshpande/ai-agent-automation |
| Package | backend |
| Ecosystem | npm |
| Severity | High |
| CVSS | 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Weakness | CWE-862 |
| Published | GitHub repository advisory: 2026-06-05 |
| Patched version | v0.9.1 |
| Public database status | GitHub repository advisory published; CVE.org, NVD, and OSV did not return records as of 2026-07-09 |
The backend memory APIs were authenticated but did not verify that the requested memory records belonged to the authenticated user. A user who knew or obtained another user's agentId or memory _id could query or delete memory records that belonged to a different account.
The affected controller was backend/src/controllers/memory.controller.js.
| Package | Affected |
|---|---|
backend | <= 0.8.0 |
| Package | Fixed |
|---|---|
backend | v0.9.1 |
chaitanyagarware/chaitanyagarware profile README references this CVE/GHSA.chaitanyagarware/chaitanyagarware.github.io references this CVE/GHSA.This repository is a public index and portfolio landing page. It intentionally summarizes the vulnerability and links to authoritative records instead of copying full proof-of-concept exploit scripts.
| Source | Status | Link |
|---|
| GitHub repository advisory | Published | GHSA-qv97-83w4-ff86 |
| CVE.org | Not indexed yet | CVE detail |
| NVD | Not indexed yet | NVD detail |
| OSV | Not indexed yet | OSV lookup |