Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a security flaw that allows users to access data outside of their assigned workspace. An authenticated user could view, modify, or delete projects belonging to other organizations or teams by manipulating project identifiers in web requests. This could lead to the unauthorized exposure of sensitive project details, descriptions, and statistics, or the accidental/malicious deletion of another team's work.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the project CRUD endpoints (GET/PATCH/DELETE) within `src/praisonai-platform/praisonai_platform/api/routes/projects.py`. While the application validates that a user is a member of the `workspace_id` provided in the URL, it fails to verify that the requested `project_id` actually belongs to that workspace. The `ProjectService` performs lookups using only the primary key (`project_id`) without a `workspace_id` predicate. An authenticated attacker can provide their own valid `workspace_id` and a target `project_id` from a different workspace to read, update, or delete project data. This issue is resolved in version 0.1.4 by ensuring resource lookups are scoped to the validated workspace.
Affected products
- MervinPraison praisonai-platform < 0.1.4
Timeline
- 2026-05-19: patched: Fix merged in PR #1685
- 2026-07-21: disclosed: CVE-2026-47418 published