Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a flaw that allows any member of a workspace to modify its core settings and metadata. Typically, only workspace owners should have the authority to rename a workspace or change its configuration. An attacker with basic member access could exploit this to rename workspaces, change descriptions, or inject malicious configuration settings, potentially redirecting AI data to external servers or altering how the platform functions.
Technical details
An authorization bypass exists in the `PATCH /workspaces/{workspace_id}` endpoint of the PraisonAI Platform. The endpoint is protected by the `require_workspace_member` dependency, which defaults to a `min_role` of "member" rather than "owner." Consequently, any authenticated user with member-level access to a workspace can modify the workspace's name, description, and the `settings` JSON blob. Because the `settings` field is a free-form JSON object used by downstream components, this vulnerability serves as a configuration-injection primitive. Attackers could potentially manipulate feature flags, webhook URLs, or LLM provider configurations. The issue is addressed in version 0.1.4 by enforcing stricter role requirements.
Affected products
- MervinPraison praisonai-platform < 0.1.4
Timeline
- 2026-05-19: advisory: GitHub Security Advisory published
- 2026-07-21: disclosed: CVE published to NVD
- 2026-07-21: patched: Version 0.1.4 released to address the issue