CVE-2026-47399
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
In PraisonAI Platform before version 0.1.4, workspace-scoped REST routes have an object-level authorization flaw allowing an authenticated user from one workspace to access objects of another workspace by supplying the victim's global UUID.
Risk Assessment
An attacker could read, modify, or delete data belonging to other workspaces, breaking platform isolation.
Recommendation
Update PraisonAI Platform to version 0.1.4 or later.
Other vulnerabilities in PraisonAI Platform
See all- CVE-2026-61441Medium
A vulnerability in PraisonAI Platform before version 0.1.9 allows unauthorized deletion of issue dependencies. The authorization mechanism only checks permissions for the endpoint selected by the caller, enabling a workspace member to delete a dependency created by an owner by targeting a related member-owned issue endpoint.
- CVE-2026-47416Critical
PraisonAI Platform versions prior to 0.1.4 have a privilege escalation vulnerability in the PATCH /workspaces/{workspace_id}/members/{user_id} endpoint. There is no caller permission check, allowing a user with the 'member' role to change any member's role, including their own, to 'owner'.
- CVE-2026-47413Critical
PraisonAI Platform versions prior to 0.1.4 have a privilege escalation and cross-tenant member injection vulnerability. The POST /workspaces/{workspace_id}/members endpoint lacks caller permission checks, allowing a user with the lowest role to add any user as an owner of the workspace.
- CVE-2026-47410Critical
PraisonAI Platform versions prior to 0.1.4 use a hardcoded default JWT secret 'dev-secret-change-me' when PLATFORM_JWT_SECRET is unset. The safety check is bypassed because PLATFORM_ENV defaults to 'dev'. An attacker can read the secret from a public source file, forge a JWT with arbitrary claims, and authenticate as any user, including admins.
- CVE-2026-47407Critical
PraisonAI Platform before version 0.1.4 has a vulnerability due to missing verification of resource ownership within workspaces in API endpoints. A user who is a member of one workspace can access resources of another workspace by manipulating the URL path. Additionally, the role hierarchy is not enforced in member management, allowing a basic member to escalate privileges to admin or owner.
- CVE-2026-47419High
IDOR vulnerability in PraisonAI Platform before 0.1.4. A user who is a member of any workspace can read, modify, or delete agents from another workspace due to missing workspace constraint. Fixed in version 0.1.4.
- CVE-2026-47418High
Vulnerability in PraisonAI Platform before version 0.1.4. An IDOR (Insecure Direct Object Reference) flaw in project CRUD endpoints allows a member of any workspace to read, modify, delete, or read stats of projects belonging to another workspace.
- CVE-2026-47417High
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) in comment endpoints allows a member of any workspace to read and post comments to issues in other workspaces without verifying issue ownership.
- CVE-2026-47415High
An IDOR vulnerability in PraisonAI Platform allows a member of one workspace to read, modify, or delete issues belonging to another workspace. The issue exists in versions prior to 0.1.4.
- CVE-2026-47414High
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) allows an authenticated workspace member to manipulate labels and issues belonging to other workspaces. No verification that the label/issue belongs to the workspace.
Original NVD description (English source)
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL. As a result, a valid member of `workspace_attacker` can call a route under `/api/v1/workspaces/{workspace_attacker}/...` while supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID. This breaks the platform's workspace isolation boundary. PraisonAI Platform version 0.1.4 patches the issue.