CVE-2026-47407

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

• CWE-269
• CWE-639
• CWE-863

• https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47
• https://github.com/MervinPraison/PraisonAI/pull/1686
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h8q5-cp56-rr65
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-h8q5-cp56-rr65

Published

Jul 21, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47397PraisonAI is a multi-agent teams system. Prior to version 4.…7.1
• CVE-2026-47398PraisonAI is a multi-agent teams system. The v4.6.32 chokepo…8.1
• CVE-2026-47399PraisonAI Platform is the platform layer for the PraisonAI m…8.8
• CVE-2026-4740A flaw was found in Open Cluster Management (OCM), the techn…8.2
• CVE-2026-47405PraisonAI Platform is the platform layer for the PraisonAI m…8.8
• CVE-2026-47406PraisonAI Platform is the platform layer for the PraisonAI m…8.1
• CVE-2026-47408PraisonAI Platform is the platform layer for the PraisonAI m…6.5
• CVE-2026-47409PraisonAI Platform is the platform layer for the PraisonAI m…8.1
• CVE-2026-4741Improper Limitation of a Pathname to a Restricted Directory …8.6
• CVE-2026-47410PraisonAI Platform is the platform layer for the PraisonAI m…9.8
• CVE-2026-47411PraisonAI Platform is the platform layer for the PraisonAI m…6.5
• CVE-2026-47412PraisonAI Platform is the platform layer for the PraisonAI m…8.1