Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a security flaw that allows users to access data outside of their assigned workspace. An authenticated user can view, modify, or delete sensitive objects like agents, projects, and issues belonging to other organizations by manipulating unique identifiers in web requests. This bypasses the platform's intended isolation between different customers or teams, potentially leading to unauthorized data exposure or loss.
Technical details
The PraisonAI Platform (prior to version 0.1.4) suffers from an Insecure Direct Object Reference (IDOR) vulnerability due to a failure to bind workspace membership authorization with object ownership validation. While the route layer verifies that a user is a member of the 'workspace_id' provided in the REST URL, the underlying service layer resolves target objects (such as agents, projects, issues, and comments) using only their global UUID. Because the service layer does not verify that the resolved object actually belongs to the workspace specified in the URL, an authenticated attacker can perform CRUD operations on any object across the platform if they know its UUID. This was patched in version 0.1.4 by enforcing workspace-scoped lookups in the service layer.
Affected products
- MervinPraison PraisonAI Platform < 0.1.4
Timeline
- 2026-05-19: patched: Fix committed in version 0.1.4
- 2026-07-21: disclosed: CVE-2026-47399 published