CVE-2026-47407 in PraisonAI
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform presents a critical authorization and authentication vulnerability that fundamentally undermines tenant isolation and access control within its multi-agent teams architecture. This vulnerability stems from a flawed implementation of workspace-based access controls where the authentication mechanism only validates user membership in the workspace specified in the URL path but fails to verify that the requested resource actually belongs to that same workspace. The flaw exists in the core routing logic where FastAPI's dependency injection system `require_workspace_member(workspace_id)` performs only a superficial check against the workspace identifier in the request path without cross-validating the actual resource ownership. This creates a classic privilege escalation and data leakage scenario where authenticated users can access resources from other workspaces by simply substituting the resource ID in the URL while maintaining their valid workspace membership.
The vulnerability manifests through multiple attack vectors that collectively demonstrate a complete breakdown of authorization controls. The primary issue occurs when users exploit the path parameter validation to request resources belonging to different workspaces by manipulating the URL structure. For instance, a user who is a member of workspace 123 can construct a request like `/api/v1/workspaces/123/agents/456` where agent 456 actually belongs to workspace 789, and the system will return that resource despite the mismatch. This represents a direct violation of the principle of least privilege and creates significant data exposure risks across tenant boundaries. The authentication bypass is further compounded by the absence of proper role validation enforcement within member management operations, where basic members can manipulate their own roles or those of other users without appropriate authorization checks.
The security implications extend beyond simple information disclosure to encompass complete administrative control over workspace resources. In the member management routes, the inherited default minimum role requirement of "member" allows unauthorized users to elevate their privileges, demote legitimate members, remove users from workspaces, and ultimately delete entire workspaces. This represents a critical failure in role-based access control implementation where the schema defines proper role hierarchies but the runtime enforcement mechanism fails to respect these boundaries. The vulnerability affects core administrative operations that should be restricted to workspace owners or administrators, creating opportunities for malicious actors to completely compromise workspace integrity and data availability.
The platform's authentication system presents an additional critical weakness through open registration without email verification mechanisms, creating a path for unauthorized users to establish accounts from any network position. This vulnerability is particularly dangerous when combined with the default server binding to `0.0.0.0:8000` which exposes the entire API surface to unauthenticated network access. The combination of these flaws creates an attack scenario where a single curl command from an external network position can establish initial system access and begin exploiting the authorization bypasses. This configuration violates fundamental security practices for network service exposure and authentication flow design, as defined in CWE-284 for improper access control and CWE-312 for exposure of sensitive information.
The remediation implemented in version 0.1.4 addresses these core issues through proper resource ownership validation where each request is verified against the actual workspace membership of the requested resource, enforcement of role hierarchies in administrative operations, and implementation of proper authentication controls including email verification requirements. Additionally, the default server binding configuration should be updated to restrict access to specific network interfaces rather than exposing all network interfaces. These fixes align with ATT&CK techniques related to privilege escalation and credential access, addressing the fundamental architectural flaws that allowed cross-tenant resource access and unauthorized administrative actions through improper authorization enforcement mechanisms.