PT-2026-45487 · Unknown · Praisonai-Platform

CVE-2026-47415

·

Published

2026-06-01

·

Updated

2026-07-21

CVSS v3.1

8.3

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)
Description An Insecure Direct Object Reference (IDOR) exists in the issue CRUD endpoints. The application validates if a user is a member of a workspace but fails to verify if the requested issue actually belongs to that workspace. This allows a member of any workspace to read, modify, or delete issues from any other workspace if they possess the issue UUID. The issue is caused by the IssueService.get(), IssueService.update(), and IssueService.delete() functions performing primary-key lookups without a workspace constraint.
API Endpoints:
  • GET /workspaces/{workspace id}/issues/{issue id}
  • PATCH /workspaces/{workspace id}/issues/{issue id}
  • DELETE /workspaces/{workspace id}/issues/{issue id}
Vulnerable Parameters or Variables:
  • workspace id
  • issue id
Function Names:
  • IssueService.get()
  • IssueService.update()
  • IssueService.delete()
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Modify the IssueService.get(), IssueService.update(), and IssueService.delete() functions to require and validate the workspace id during the resource lookup to ensure the issue belongs to the specified workspace. Restrict the use of the issue id parameter in the affected API endpoints by ensuring the backend enforces a workspace-level ownership check before processing the request.

Exploit

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-47415
GHSA-XWQ8-FRCG-77Q8
PYSEC-2026-2939

Affected Products

Praisonai-Platform