PT-2026-45488 · Unknown · Praisonai-Platform
CVE-2026-47417
·
Published
2026-06-01
·
Updated
2026-07-21
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
praisonai-platform (affected versions not specified)
Description
An Insecure Direct Object Reference (IDOR) exists in the comment endpoints. The system verifies if a user is a member of a workspace but fails to verify if the requested issue belongs to that specific workspace. This allows a member of any workspace to read all comments on or post new comments to any issue in any other workspace, provided they have the issue UUID. This is caused by the
CommentService.create() and CommentService.list for issue() functions trusting the issue id provided in the URL without a workspace-scoped validation. Affected API endpoints include POST /workspaces/{workspace id}/issues/{issue id}/comments and GET /workspaces/{workspace id}/issues/{issue id}/comments, specifically involving the issue id and workspace id variables.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, restrict access to the
POST /workspaces/{workspace id}/issues/{issue id}/comments and GET /workspaces/{workspace id}/issues/{issue id}/comments endpoints to ensure only authorized workspace members can access issues belonging to their own workspace.Exploit
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Praisonai-Platform