CVE-2026-47408
Last modified
CVE-2026-47408 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity` endpoint is gated by `require_workspace_member(workspace_id)` and dispatches to `ActivityService.list_for_issue(issue_id)`, which executes `SELECT * FROM activity WHERE issue_id = :issue_id` with no workspace constraint. A user who is a member of any workspace can read the full activity log of any issue across the entire multi-tenant deployment. PraisonAI Platform version 0.1.4 patches the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| MervinPraison | praisonai-platform | < 0.1.4 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-47408?
How severe is CVE-2026-47408?
How do I fix CVE-2026-47408?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-47398PraisonAI is a multi-agent teams system. The v4.6.32 chokepo…8.1
- CVE-2026-47399PraisonAI Platform is the platform layer for the PraisonAI m…8.8
- CVE-2026-4740A flaw was found in Open Cluster Management (OCM), the techn…8.2
- CVE-2026-47405PraisonAI Platform is the platform layer for the PraisonAI m…8.8
- CVE-2026-47406PraisonAI Platform is the platform layer for the PraisonAI m…8.1
- CVE-2026-47407PraisonAI Platform is the platform layer for the PraisonAI m…9.4
- CVE-2026-47409PraisonAI Platform is the platform layer for the PraisonAI m…8.1
- CVE-2026-4741Improper Limitation of a Pathname to a Restricted Directory …8.6
- CVE-2026-47410PraisonAI Platform is the platform layer for the PraisonAI m…9.8
- CVE-2026-47411PraisonAI Platform is the platform layer for the PraisonAI m…6.5
- CVE-2026-47412PraisonAI Platform is the platform layer for the PraisonAI m…8.1
- CVE-2026-47413PraisonAI Platform is the platform layer for the PraisonAI m…9.6
Are you affected by CVE-2026-47408?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST