Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains multiple security flaws that allow users to access or delete data belonging to other organizations. Because the system does not properly verify resource ownership or enforce user roles, any registered user can view private project details, promote themselves to administrator status, or delete entire workspaces. Additionally, the software defaults to an insecure network configuration that makes it easier for unauthorized users to gain initial access.
Technical details
PraisonAI Platform prior to 0.1.4 suffers from two primary authorization flaws. First, an IDOR vulnerability exists because the `require_workspace_member` FastAPI dependency only validates that a user belongs to the `workspace_id` in the URL, while the underlying route handlers fetch resources (agents, issues, projects, etc.) by primary key without verifying they belong to that workspace. Second, member-management routes fail to enforce role hierarchies, allowing users with 'member' privileges to perform administrative actions like self-promotion or workspace deletion. Furthermore, the platform defaults to binding on `0.0.0.0` and allows open registration without email verification, facilitating unauthorized access. These issues are addressed in version 0.1.4.
Affected products
- MervinPraison PraisonAI Platform < 0.1.4
Timeline
- 2026-05-19: patched: Fixes merged in PR #1686
- 2026-05-19: advisory: GitHub Security Advisory GHSA-h8q5-cp56-rr65 published
- 2026-07-21: disclosed: CVE-2026-47407 published to NVD