CVE-2026-47406 in PraisonAI
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints (`POST/GET /workspaces/{workspace_id}/issues/{issue_id}/dependencies` and `DELETE .../dependencies/{dep_id}`) gate access on `require_workspace_member(workspace_id)` only, then dispatch to `DependencyService` calls that take URL/body-supplied issue and dependency IDs without verifying any of them belong to the membership-checked workspace. Most damaging: `create_dependency` accepts `body.depends_on_issue_id` from the request body — that ID is checked against nothing — letting an attacker create a "blocks" or "related" link between any two issues anywhere in the database. PraisonAI Platform version 0.1.4 patches the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform vulnerability represents a critical Insecure Direct Object Reference (IDOR) flaw that fundamentally undermines the system's access control mechanisms. This weakness exists in versions prior to 0.1.4 and specifically affects the dependency management endpoints that handle workspace-related operations. The vulnerability operates through a fundamental architectural flaw where the platform performs initial access validation using `require_workspace_member(workspace_id)` but fails to enforce subsequent object ownership verification during dependency operations. This creates a dangerous scenario where authenticated users can manipulate database objects beyond their intended scope, directly violating core security principles of least privilege and object isolation.
The technical implementation of this vulnerability manifests through the dependency endpoints that accept workspace, issue, and dependency identifiers through both URL parameters and request bodies. The `POST/GET /workspaces/{workspace_id}/issues/{issue_id}/dependencies` and `DELETE .../dependencies/{dep_id}` routes perform preliminary access checks against the workspace membership but then delegate operations to `DependencyService` methods without additional validation of object relationships. The most severe aspect occurs in the `create_dependency` method which accepts `body.depends_on_issue_id` directly from the request payload without any verification that this dependency target belongs to the same workspace context as the initiating operation. This design flaw allows attackers to create arbitrary relationship links between issues regardless of their actual workspace membership or ownership, effectively enabling cross-workspace data manipulation.
The operational impact of this vulnerability extends far beyond simple data exposure, creating potential for significant system compromise and data integrity violations. An attacker with access to a single workspace can leverage this vulnerability to establish "blocks" or "related" relationships between issues across different workspaces, potentially disrupting workflow processes, creating false dependencies that could lead to incorrect task prioritization, or even enabling more sophisticated attacks such as privilege escalation through carefully crafted dependency chains. The vulnerability also undermines audit trails and data lineage tracking since the system cannot guarantee the authenticity of relationship metadata. From a compliance perspective, this represents a serious deviation from security best practices and could violate standards such as those outlined in the OWASP Top 10 A05:2021 - Security Misconfiguration and CWE-284: Improper Access Control, which specifically addresses inadequate access control mechanisms.
The remediation implemented in version 0.1.4 demonstrates a proper approach to addressing IDOR vulnerabilities through comprehensive object validation and relationship verification. The patch ensures that all dependency operations validate not only workspace membership but also verify that both source and target issues belong to the same workspace context before allowing any dependency creation or modification operations. This aligns with ATT&CK technique T1078.004 - Valid Accounts: Cloud Accounts, where proper access control enforcement prevents unauthorized cross-domain operations, and represents a fundamental improvement in the platform's authorization model. Organizations should immediately upgrade to version 0.1.4 or later and conduct thorough security assessments of any existing dependencies that might have been manipulated by attackers exploiting this vulnerability. The fix also emphasizes the importance of implementing defense-in-depth strategies where multiple layers of validation work together to prevent similar issues, particularly in multi-tenant systems where proper object isolation is critical for maintaining system integrity and user privacy.
This vulnerability serves as a stark reminder of the critical importance of proper access control implementation in modern web applications, especially those handling multi-tenant data environments. The flaw demonstrates how seemingly minor architectural oversights can create significant security risks, particularly when dealing with relationship-based data operations that require careful validation of object ownership and scope. Security teams should implement comprehensive testing procedures including automated scanning for IDOR vulnerabilities and manual review of access control logic in all application components handling user-facing data relationships. The vulnerability also highlights the necessity of following secure coding practices as recommended by NIST SP 800-53 controls related to access control and system integrity, where proper object validation should be enforced at multiple levels within the application stack to prevent unauthorized operations across system boundaries.