Executive brief
PraisonAI Platform, a system for managing multi-agent AI teams, contains a security flaw that allows users to access or modify data belonging to other organizations. By manipulating web requests, an authorized user in one workspace can view, change, or delete AI agents in a different workspace if they know the agent's unique ID. This could lead to the theft of proprietary AI instructions, the redirection of AI traffic to malicious servers, or the deletion of critical agent configurations.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`). While the application verifies that the requesting user is a member of the `workspace_id` provided in the URL, the underlying `AgentService.get` method performs a primary-key lookup on `agent_id` without verifying that the agent actually belongs to that specific workspace. An authenticated attacker can exploit this by supplying their own valid `workspace_id` while targeting an `agent_id` belonging to a different workspace. This allows the attacker to read agent configurations (including system prompts and runtime configs), modify agent behavior, or delete agents entirely. The issue is resolved in version 0.1.4 by ensuring the workspace constraint is included in the database query.
Affected products
- MervinPraison praisonai-platform < 0.1.4
Timeline
- 2026-05-19: patched: Fix committed to repository
- 2026-07-21: disclosed: CVE published to NVD