Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a security flaw that allows users to view activity logs they should not be able to see. A user who is a member of any workspace can access the full history and activity details of issues belonging to other organizations or workspaces. This could lead to the exposure of sensitive operational data, including who performed specific actions and the details of changes made to AI projects.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `GET /workspaces/{workspace_id}/issues/{issue_id}/activity` endpoint of the PraisonAI Platform. While the endpoint uses a `require_workspace_member` dependency to verify the requester belongs to the `workspace_id` provided in the URL, the underlying service call `ActivityService.list_for_issue(issue_id)` fails to validate that the requested `issue_id` actually belongs to that workspace. Consequently, an authenticated user can provide their own valid workspace ID and any target issue UUID to retrieve the full activity log for that issue, including actor identities and change details (JSON blobs). This vulnerability is patched in version 0.1.4.
Affected products
- MervinPraison PraisonAI Platform < 0.1.4
Timeline
- 2026-05-19: patched: Fix committed to main branch
- 2026-07-21: disclosed: CVE-2026-47408 published