PT-2026-45484 · Unknown · Praisonai-Platform

CVE-2026-47411

·

Published

2026-06-01

·

Updated

2026-07-21

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)
Description An authorization bypass exists that allows users with member-level privileges to tamper with workspace metadata and settings. The issue occurs because the PATCH /workspaces/{workspace id} endpoint only requires the user to be a member of the workspace, failing to verify if the user has owner-level permissions. This allows any member to modify the name, description, and the settings JSON blob of a workspace.
Because the settings field is a free-form JSON object, it can be used as a configuration-injection primitive. Depending on how downstream code processes these settings, an attacker could potentially flip feature flags, redirect webhook URLs, change LLM provider keys for shared configurations, or disable audit logging.
Technical details:
  • API Endpoint: PATCH /workspaces/{workspace id}
  • Vulnerable Parameters: name, description, and settings
  • Vulnerable Function: update workspace()
Recommendations
  • Update the update workspace() function to require owner-level permissions instead of member-level permissions.
  • Implement an allowlist to validate the keys permitted within the settings parameter to prevent arbitrary configuration injection.
  • Restrict access to the PATCH /workspaces/{workspace id} endpoint to only authorized owners.

Exploit

Fix

Missing Authorization

Improper Privilege Management

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862CWE-269

Related Identifiers

CVE-2026-47411
GHSA-RCMC-Q9RJ-4WMQ
PYSEC-2026-2937

Affected Products

Praisonai-Platform