{"action":"Upgrade aegra-api to 0.9.7 or later.","affected":[{"fixed":"0.9.7","introduced":"0.9.0"}],"component":"aegra-api","cve_ids":["CVE-2026-44504"],"ecosystem":"PyPI","epss":0.00285,"exploited":false,"fixed_versions":["0.9.7"],"ghsa_id":"GHSA-m98r-6667-4wq7","id":"tcs_01M5KFQRMA3EH21D2RSFZT7BRZ","modified_at":"2026-07-13T16:42:39.928198607Z","published_at":"2026-05-07T01:49:51Z","references":["https://osv.dev/vulnerability/GHSA-m98r-6667-4wq7","https://github.com/aegra/aegra/security/advisories/GHSA-m98r-6667-4wq7","https://nvd.nist.gov/vuln/detail/CVE-2026-44504","https://github.com/aegra/aegra/issues/336","https://github.com/aegra/aegra/pull/337","https://github.com/aegra/aegra/commit/e1b2042254fd49072ca281bc35b3f2a3bed74b31","https://github.com/aegra/aegra","https://github.com/aegra/aegra/releases/tag/v0.9.7"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-m98r-6667-4wq7","url":"https://osv.dev/vulnerability/GHSA-m98r-6667-4wq7"},{"source":"nvd","source_id":"CVE-2026-44504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44504"}],"summary":"Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)"}