PT-2026-45485 · Unknown · Praisonai-Platform
CVE-2026-47412
·
Published
2026-06-01
·
Updated
2026-07-21
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
praisonai-platform (affected versions not specified)
Description
An authorization bypass exists that allows any member of a workspace to perform a destructive deletion of the entire workspace. The issue occurs because the
DELETE /workspaces/{workspace id} endpoint uses a dependency that defaults to a minimum role of member, failing to restrict the action to workspace owners. Consequently, a low-privilege user can trigger the delete() function in the WorkspaceService class, which irreversibly wipes the workspace and all associated resources, including projects, issues, comments, agents, labels, and member records, via cascading foreign-key relationships. This action is immediate and provides no recovery path or audit trail.Recommendations
Restrict the
DELETE /workspaces/{workspace id} endpoint to require the owner role by updating the dependency to use min role="owner".
As a temporary mitigation, restrict access to the DELETE /workspaces/{workspace id} endpoint to only trusted administrative users.Exploit
Fix
Missing Authorization
Improper Privilege Management
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Praisonai-Platform