PraisonAI Platform vulnerabilities

A vulnerability in PraisonAI Platform before version 0.1.9 allows unauthorized deletion of issue dependencies. The authorization mechanism only checks permissions for the endpoint selected by the caller, enabling a workspace member to delete a dependency created by an owner by targeting a related member-owned issue endpoint.

PraisonAI Platform versions prior to 0.1.4 have a privilege escalation vulnerability in the PATCH /workspaces/{workspace_id}/members/{user_id} endpoint. There is no caller permission check, allowing a user with the 'member' role to change any member's role, including their own, to 'owner'.

PraisonAI Platform versions prior to 0.1.4 have a privilege escalation and cross-tenant member injection vulnerability. The POST /workspaces/{workspace_id}/members endpoint lacks caller permission checks, allowing a user with the lowest role to add any user as an owner of the workspace.

PraisonAI Platform versions prior to 0.1.4 use a hardcoded default JWT secret 'dev-secret-change-me' when PLATFORM_JWT_SECRET is unset. The safety check is bypassed because PLATFORM_ENV defaults to 'dev'. An attacker can read the secret from a public source file, forge a JWT with arbitrary claims, and authenticate as any user, including admins.

PraisonAI Platform before version 0.1.4 has a vulnerability due to missing verification of resource ownership within workspaces in API endpoints. A user who is a member of one workspace can access resources of another workspace by manipulating the URL path. Additionally, the role hierarchy is not enforced in member management, allowing a basic member to escalate privileges to admin or owner.

IDOR vulnerability in PraisonAI Platform before 0.1.4. A user who is a member of any workspace can read, modify, or delete agents from another workspace due to missing workspace constraint. Fixed in version 0.1.4.

Vulnerability in PraisonAI Platform before version 0.1.4. An IDOR (Insecure Direct Object Reference) flaw in project CRUD endpoints allows a member of any workspace to read, modify, delete, or read stats of projects belonging to another workspace.

IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) in comment endpoints allows a member of any workspace to read and post comments to issues in other workspaces without verifying issue ownership.

An IDOR vulnerability in PraisonAI Platform allows a member of one workspace to read, modify, or delete issues belonging to another workspace. The issue exists in versions prior to 0.1.4.

IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) allows an authenticated workspace member to manipulate labels and issues belonging to other workspaces. No verification that the label/issue belongs to the workspace.

Vulnerability in PraisonAI Platform before version 0.1.4. Missing authorization on the DELETE /workspaces/{workspace_id} endpoint allows any workspace member to delete the entire workspace along with all associated data (projects, issues, comments, agents, labels, member records).

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.

A vulnerability in PraisonAI Platform allows any workspace member to remove any other member, including the workspace owner, without role checking. The issue exists in versions prior to 0.1.4.

Vulnerability in PraisonAI Platform (versions prior to 0.1.4) involving Insecure Direct Object Reference (IDOR). The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity` endpoint does not enforce workspace membership, allowing any workspace member to read the full activity log of any issue across the multi-tenant deployment.

Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform before version 0.1.4. Dependency endpoints do not verify that issue and dependency IDs belong to the checked workspace, allowing an attacker to create links between any issues in the database.

Vulnerability in PraisonAI Platform before version 0.1.4. Broken access control in workspace management routes allows any authenticated low-privilege member to escalate their role to owner.

In PraisonAI Platform before version 0.1.4, workspace-scoped REST routes have an object-level authorization flaw allowing an authenticated user from one workspace to access objects of another workspace by supplying the victim's global UUID.

A vulnerability in PraisonAI Platform before version 0.1.9 allows workspace members to rename and recolor shared labels and add/remove labels on owner-created issues. Attackers with member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy without owner or admin authorization.

A vulnerability in PraisonAI Platform before version 0.1.9 allows a workspace member to modify owner-created records such as projects, issues, and agents without required owner or admin authorization. For projects, a member can reassign the lead_id to their own user ID and then delete the project, bypassing the delete route's owner/admin permission check.