What happened
An IDOR (insecure direct object reference) flaw in the agent-memory controller of this workflow automation platform lets any authenticated user manipulate other users' agent memory records by supplying arbitrary agent/memory identifiers.
Why it matters
Agent memory can contain sensitive conversation history and context; unauthorized cross-tenant read/delete access undermines multi-tenant isolation, though the narrow single-project blast radius keeps this a lower-tier finding.
Attack vector
listMemories, deleteMemory, and clearAgentMemory endpoints authenticate the caller but use a caller-supplied agentId or memory _id without verifying the caller owns that agent/memory, allowing any authenticated user to read or delete another user's agent memory.
Affected systems
AI Agent Automation < 0.9.1
Mitigation
Upgrade to AI Agent Automation 0.9.1 or later.