CVE-2026-47416
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
PraisonAI Platform versions prior to 0.1.4 have a privilege escalation vulnerability in the PATCH /workspaces/{workspace_id}/members/{user_id} endpoint. There is no caller permission check, allowing a user with the 'member' role to change any member's role, including their own, to 'owner'.
Risk Assessment
An attacker can gain unauthorized access to workspace management, take over the system, and steal data.
Recommendation
Immediately upgrade to version 0.1.4 or later, which fixes this vulnerability.
Other vulnerabilities in PraisonAI Platform
See all- CVE-2026-62179Medium
In praisonai-platform prior to 0.1.9, dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependency through a member-owned related issue endpoint because the route accepts either endpoint and checks delete permission only against the caller-selected URL issue. Version 0.1.9 patches the issue.
- CVE-2026-47413Critical
PraisonAI Platform versions prior to 0.1.4 have a privilege escalation and cross-tenant member injection vulnerability. The POST /workspaces/{workspace_id}/members endpoint lacks caller permission checks, allowing a user with the lowest role to add any user as an owner of the workspace.
- CVE-2026-47410Critical
PraisonAI Platform versions prior to 0.1.4 use a hardcoded default JWT secret 'dev-secret-change-me' when PLATFORM_JWT_SECRET is unset. The safety check is bypassed because PLATFORM_ENV defaults to 'dev'. An attacker can read the secret from a public source file, forge a JWT with arbitrary claims, and authenticate as any user, including admins.
- CVE-2026-47407Critical
PraisonAI Platform before version 0.1.4 has a vulnerability due to missing verification of resource ownership within workspaces in API endpoints. A user who is a member of one workspace can access resources of another workspace by manipulating the URL path. Additionally, the role hierarchy is not enforced in member management, allowing a basic member to escalate privileges to admin or owner.
- CVE-2026-57121High
In praisonai-platform from version 0.1.4 to before 0.1.5, a workspace member can permanently delete any resource (projects, agents, issues, labels, issue dependencies, and issue-label attachments) created by the workspace owner or other members. All six content DELETE endpoints enforce workspace membership but perform no ownership or role check. The issue is patched in version 0.1.5.
- CVE-2026-47419High
IDOR vulnerability in PraisonAI Platform before 0.1.4. A user who is a member of any workspace can read, modify, or delete agents from another workspace due to missing workspace constraint. Fixed in version 0.1.4.
- CVE-2026-47418High
Vulnerability in PraisonAI Platform before version 0.1.4. An IDOR (Insecure Direct Object Reference) flaw in project CRUD endpoints allows a member of any workspace to read, modify, delete, or read stats of projects belonging to another workspace.
- CVE-2026-47417High
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) in comment endpoints allows a member of any workspace to read and post comments to issues in other workspaces without verifying issue ownership.
- CVE-2026-47415High
An IDOR vulnerability in PraisonAI Platform allows a member of one workspace to read, modify, or delete issues belonging to another workspace. The issue exists in versions prior to 0.1.4.
- CVE-2026-47414High
IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) allows an authenticated workspace member to manipulate labels and issues belonging to other workspaces. No verification that the label/issue belongs to the workspace.
Original NVD description (English source)
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role="member"` and is never overridden by the route. The handler then calls `MemberService.update_role(workspace_id, user_id, body.role)` which sets the target member's role to whatever the request body specifies, with no check that the caller has owner-or-admin privilege, no check that the new role is not higher than the caller's own, and no check that the caller is not silently promoting themselves. PraisonAI Platform version 0.1.4 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS