CVE-2026-45023

An authenticated attacker sends a POST request to `/api/blocks/{block_id}/execute` with valid block input. The external API handler in `routes.py` executes the block directly via `obj.execute(data)` without consulting the credit system [ref_id=1]. Because the credit check lives only in the graph execution path (`manager.py`), it is completely bypassed, allowing unlimited free execution of any block regardless of the user's credit balance [ref_id=1].

The vulnerability is in `autogpt_platform/backend/backend/api/external/v1/routes.py` (lines 79–94), where the `POST /api/blocks/{block_id}/execute` endpoint calls `obj.execute(data)` directly without any credit check [ref_id=1]. The credit balance check exists only in `autogpt_platform/backend/backend/executor/manager.py` inside `execute_graph()`, which is never reached when blocks are called via the external API [ref_id=1].

The advisory recommends adding a credit balance check in `routes.py` before block execution: fetch the user's credit balance via `get_user_credit_balance(auth.user_id)` and raise an HTTP 402 error if the balance is zero or below [ref_id=1]. No patch diff is provided in the bundle, but the fix is described as applying the same credit enforcement that already exists in `manager.py` to the external API endpoint [ref_id=1].

1. Authenticate as a user with zero or low credit balance on an AutoGPT instance (e.g., master branch, Docker Desktop). 2. Send a POST request to `http://localhost:3000/api/proxy/api/blocks/{block_id}/execute` with `Content-Type: application/json` and a valid block input body. 3. Observe that the block execution is attempted (HTTP 500 from `run()`) and that credits are not deducted (balance remains unchanged) [ref_id=1].