Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a security flaw that allows any workspace member to lock out other users. Because the system fails to verify if a user has administrative rights before removing members, a low-privileged user can delete the workspace owner's access. This results in a permanent loss of control for the legitimate owner and disrupts business operations within that workspace.
Technical details
An authorization bypass exists in the `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint of PraisonAI Platform. The endpoint is protected by the `require_workspace_member` dependency, which defaults to a minimum role of 'member', but it lacks additional logic to verify the caller's role relative to the target or to prevent the removal of the final workspace owner. An authenticated attacker with 'member' privileges can obtain the owner's `user_id` (via the list members endpoint) and issue a DELETE request to revoke the owner's access. This leads to a permanent lockout of the legitimate owner. The issue is addressed in version 0.1.4 by enforcing stricter role checks and workspace scoping.
Affected products
- MervinPraison PraisonAI Platform < 0.1.4
Timeline
- 2026-05-19: patched: Fix merged in security batch 3 PR #1686
- 2026-07-21: advisory: NVD and GitHub Security Advisory published