CVE-2026-47407: MervinPraison PraisonAI Platform IDOR and privilege escalation

CVE-2026-47407 · Severity: critical · CVSS 4 · Published 2026-07-21

PraisonAI Platform, a system for managing multi-agent AI teams, contains multiple security flaws that allow users to access or delete data belonging to other organizations. Because the system does not properly verify resource ownership or enforce user roles, any registered user can view private project details, promote themselves to administrator status, or delete entire workspaces. Additionally, the software defaults to an insecure network configuration that makes it easier for unauthorized users to gain initial access.

Technologies: praisonai-platform (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47407 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47407 being exploited in the wild.
How severe is CVE-2026-47407?
Critical severity, with a CVSS score of 4, published 21 July 2026.
Which products and versions are affected?
praisonai-platform (PyPI) <= 0.1.2, ECOSYSTEM:introduced=0,fixed=0.1.4.
Is there a fix for CVE-2026-47407?
Yes. praisonai-platform (PyPI): upgrade to 0.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47407 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47407?
Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai-platform (PyPI): upgrade to 0.1.4 or later
    pip install "praisonai-platform>=0.1.4"

Technical details

PraisonAI Platform prior to 0.1.4 suffers from two primary authorization flaws. First, an IDOR vulnerability exists because the `require_workspace_member` FastAPI dependency only validates that a user belongs to the `workspace_id` in the URL, while the underlying route handlers fetch resources (agents, issues, projects, etc.) by primary key without verifying they belong to that workspace. Second, member-management routes fail to enforce role hierarchies, allowing users with 'member' privileges to perform administrative actions like self-promotion or workspace deletion. Furthermore, the platform defaults to binding on `0.0.0.0` and allows open registration without email verification, facilitating unauthorized access. These issues are addressed in version 0.1.4.

Affected products

  • MervinPraison PraisonAI Platform < 0.1.4

Identifiers

  • CVE-2026-47407
  • GHSA-h8q5-cp56-rr65
  • PYSEC-2026-482

Timeline

  • 2026-05-19: patched: Fixes merged in PR #1686
  • 2026-05-19: advisory: GitHub Security Advisory GHSA-h8q5-cp56-rr65 published
  • 2026-07-21: disclosed: CVE-2026-47407 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.