{"action":"Upgrade aegra-api to 0.9.7 or later.","affected":[{"fixed":"0.9.7","introduced":"0.9.0"}],"component":"aegra-api","cve_ids":["CVE-2026-44504"],"ecosystem":"PyPI","epss":0.00351,"exploited":false,"fixed_versions":["0.9.7"],"ghsa_id":"GHSA-m98r-6667-4wq7","id":"tcs_01M5KGYT6757KT1HRE55WCSGAP","modified_at":"2026-07-13T16:31:30.415106896Z","published_at":"2026-07-13T15:15:40.572514Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2328","https://github.com/aegra/aegra/security/advisories/GHSA-m98r-6667-4wq7","https://nvd.nist.gov/vuln/detail/CVE-2026-44504","https://github.com/aegra/aegra/issues/336","https://github.com/aegra/aegra/pull/337","https://github.com/aegra/aegra/commit/e1b2042254fd49072ca281bc35b3f2a3bed74b31","https://github.com/aegra/aegra","https://github.com/aegra/aegra/releases/tag/v0.9.7","https://pypi.org/project/aegra-api","https://github.com/advisories/GHSA-m98r-6667-4wq7"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-2328","url":"https://osv.dev/vulnerability/PYSEC-2026-2328"}],"summary":"Aegra has cross-user run injection in /threads/{thread_id}/runs (IDOR)"}