PT-2026-45068 · Unknown · Praisonai-Platform

CVE-2026-48169 · Published 2026-05-29 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI Platform (affected versions not specified)

Description The PraisonAI Platform API contains authorization failures that break workspace isolation. The service layer for issues and projects performs global primary-key lookups without verifying workspace ownership, allowing any authenticated user to read, modify, or delete resources in any workspace by manipulating UUIDs in API requests. Additionally, member management endpoints only require a member role, enabling any workspace member to promote themselves to owner and remove the original owner.

Technical details include:

• API Endpoints: /api/v1/workspaces/{workspace id}/issues/{issue id} and /api/v1/workspaces/{workspace id}/projects/{project id} are susceptible to Insecure Direct Object Reference (IDOR) because the service layer ignores the workspace id provided in the URL.
• Vulnerable Parameters: The issue id and project id variables are used for global lookups without workspace scoping.
• Function Names: IssueService.get(), IssueService.update(), IssueService.delete(), ProjectService.get(), ProjectService.update(), ProjectService.delete(), and ProjectService.get stats() fail to enforce workspace boundaries. Furthermore, update member role() and remove member() in the workspace routes lack proper role hierarchy checks.

Recommendations

• Scope all get(), update(), and delete() methods in IssueService and ProjectService to verify that the resource belongs to the provided workspace id.
• Modify the API routes to pass the workspace id from the URL to the corresponding service methods.
• Update member management routes to require the owner role via the require workspace member() dependency.
• Implement guards in update member role() to prevent self-promotion and role escalation.
• Implement guards in remove member() to prevent the removal of the last workspace owner and to enforce role hierarchy.

Fix

Missing Authorization

IDOR

Weakness Enumeration

CWE-862

CWE-639

Related Identifiers

CVE-2026-48169

GHSA-GV23-XRM3-8C62

PYSEC-2026-2935

Affected Products

Praisonai-Platform

References · 7

• https://osv.dev/vulnerability/GHSA-gv23-xrm3-8c62 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48169 · Security Note
• https://github.com/MervinPraison/PraisonAI · Note
• https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gv23-xrm3-8c62 · Note
• https://pypi.org/project/praisonai-platform · Note
• https://github.com/advisories/GHSA-gv23-xrm3-8c62 · Note