CVE-2026-47411: MervinPraison PraisonAI Platform authorization bypass in workspace settings

CVE-2026-47411 · Severity: medium · CVSS 6.5 · Published 2026-07-21

PraisonAI Platform, a system for managing multi-agent AI teams, contains a flaw that allows any member of a workspace to modify its core settings and metadata. Typically, only workspace owners should have the authority to rename a workspace or change its configuration. An attacker with basic member access could exploit this to rename workspaces, change descriptions, or inject malicious configuration settings, potentially redirecting AI data to external servers or altering how the platform functions.

Technologies: praisonai-platform (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-47411 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47411 being exploited in the wild.
How severe is CVE-2026-47411?
Medium severity, with a CVSS score of 6.5, published 21 July 2026.
Which products and versions are affected?
praisonai-platform (PyPI) < 0.1.4, ECOSYSTEM:introduced=0,fixed=0.1.4.
Is there a fix for CVE-2026-47411?
Yes. praisonai-platform (PyPI): upgrade to 0.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47411 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-47411?
Check whether you run praisonai-platform (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • praisonai-platform (PyPI): upgrade to 0.1.4 or later
    pip install "praisonai-platform>=0.1.4"

Technical details

An authorization bypass exists in the `PATCH /workspaces/{workspace_id}` endpoint of the PraisonAI Platform. The endpoint is protected by the `require_workspace_member` dependency, which defaults to a `min_role` of "member" rather than "owner." Consequently, any authenticated user with member-level access to a workspace can modify the workspace's name, description, and the `settings` JSON blob. Because the `settings` field is a free-form JSON object used by downstream components, this vulnerability serves as a configuration-injection primitive. Attackers could potentially manipulate feature flags, webhook URLs, or LLM provider configurations. The issue is addressed in version 0.1.4 by enforcing stricter role requirements.

Affected products

  • MervinPraison praisonai-platform < 0.1.4

Identifiers

  • CVE-2026-47411
  • GHSA-rcmc-q9rj-4wmq
  • PYSEC-2026-2937

Timeline

  • 2026-05-19: advisory: GitHub Security Advisory published
  • 2026-07-21: disclosed: CVE published to NVD
  • 2026-07-21: patched: Version 0.1.4 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.