PT-2026-45061 · Unknown · Praisonai-Platform
CVE-2026-47407
·
Published
2026-05-29
·
Updated
2026-07-21
CVSS v4.0
9.4
Critical
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
PraisonAI Platform (affected versions not specified)
Description
The server contains multiple authorization flaws. First, a cross-tenant Insecure Direct Object Reference (IDOR) exists because the
require workspace member() dependency only validates the workspace id in the URL prefix but does not verify if the requested inner resource belongs to that workspace. An attacker can use their own workspace id in the URL and a victim's resource ID in the path to read, update, or delete resources across different tenants. Affected endpoints include those under /api/v1/workspaces/{workspace id}/... for agents, issues, projects, labels, and dependencies.Second, a privilege escalation flaw exists in member-management routes, such as
update member role, add member, remove member, update workspace, and delete workspace. These routes use a default minimum role of member, allowing any basic member to promote themselves to admin or owner, remove other members, or delete the entire workspace.Additionally, the system is highly exposed by default as it binds to
0.0.0.0:8000 and allows open registration at /api/v1/auth/register without email verification.Recommendations
Re-scope all nested-resource lookups in
routes/agents.py, routes/issues.py, routes/projects.py, routes/labels.py, and routes/dependencies.py to ensure the resource's workspace id matches the workspace id provided in the URL.
Enforce a minimum role of admin for privileged operations in routes/workspaces.py, specifically for update member role, add member, remove member, update workspace, and delete workspace.Exploit
Fix
IDOR
Incorrect Authorization
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform