CVE-2026-47407
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
PraisonAI Platform before version 0.1.4 has a vulnerability due to missing verification of resource ownership within workspaces in API endpoints. A user who is a member of one workspace can access resources of another workspace by manipulating the URL path. Additionally, the role hierarchy is not enforced in member management, allowing a basic member to escalate privileges to admin or owner.
Risk Assessment
The organization is at risk of unauthorized cross-tenant data access, potentially leading to leakage of sensitive information. Moreover, regular users can escalate their privileges, taking over or deleting workspaces.
Recommendation
Immediately update PraisonAI Platform to version 0.1.4 or later. If an update is not possible, restrict API access via firewall or network authentication and implement additional server-side validation.
Original NVD description (English source)
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.