PT-2026-45059 · Unknown · Praisonai-Platform
CVE-2026-47405
·
Published
2026-05-29
·
Updated
2026-07-13
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai-platform version 0.1.2
Description
A broken access control issue allows an authenticated low-privilege workspace member to perform vertical privilege escalation and take full control of a workspace. The problem stems from the
require workspace member() function in praisonai platform/api/deps.py, which defaults the min role variable to member. Consequently, administrative routes that should require admin or owner roles are accessible to any member.An attacker can exploit this by targeting the following API endpoints:
- 'PATCH /workspaces/{workspace id}'
- 'DELETE /workspaces/{workspace id}'
- 'POST /workspaces/{workspace id}/members'
- 'PATCH /workspaces/{workspace id}/members/{user id}'
- 'DELETE /workspaces/{workspace id}/members/{user id}'
By manipulating the
role variable in these requests, a member can promote themselves to owner, add other unauthorized users as administrators, or remove legitimate owners from the workspace.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Missing Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform