Submitted by unforgiven, also found by Picodes
According to Aave documentation, when requesting flash-loan, its possible to specify a receiver, so function executeOperation() of that receiver will be called by lendingPool.
https://docs.aave.com/developers/v/2.0/guides/flash-loans
In the SuperVault there is no check to prevent this attack so attacker can use this and perform  griefing attack and make miner contract lose all its funds. or he can create specifically crafted params so when executeOperation() is called by lendingPool, attacker could steal vaults user funds.
To exploit this attacker will do this steps:
To steal user fund in SupperVault attacker needs more steps. in all these actions (Operation.REBALANCE, Operation.LEVERAGE, Operation.EMPTY) contract will call aggregatorSwap() with data that are controlled by attacker.
Attacker can put special data in dexTxData that make contract to do an exchange with bad price. To do this, attacker will create a smart contract that will do this steps:
The details are:
Attacker can manipulate swapping pool price with flash-loan, then Attacker will create specific params and perform steps 1 to 4. so contract will try to exchange tokens and because of attacker price manipulation and specific dexTxData, contract will have bad deals.
After that, attacker can reverse the process of swap manipulation and get his  flash-loan tokens and some of SuperVault funds and. then pay the flash-loan.
VIM
There should be some state variable which stores the fact that SuperVault imitated flash-loan.
When contract tries to start flash-loan, it sets the isFlash to True and executeOperation() only accepts calls if isFlash is True. and after the flash loan code will set isFlash to False.
m19 (Mimo DeFi) confirmed and commented:
