CVE-2026-47409 in PraisonAI
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can remove any other member, including the workspace owner, using a single DELETE. There is no caller-role check, no target-role check, no "cannot remove last owner" guard. PraisonAI Platform version 0.1.4 patches the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability in PraisonAI Platform represents a critical authorization bypass flaw that undermines fundamental access control mechanisms within the multi-agent teams system. This security weakness affects all versions prior to 0.1.4 and stems from insufficient role-based access controls implemented in the workspace member management functionality. The core issue manifests through the DELETE endpoint at /workspaces/{workspace_id}/members/{user_id} which lacks proper authorization checks that should prevent arbitrary user removal operations. The vulnerability is classified as a direct violation of CWE-285, which addresses improper authorization within software systems, and aligns with ATT&CK technique T1078.101 for Valid Accounts and T1531 for Account Access Removal.
The technical implementation flaw lies in the endpoint's reliance solely on the `require_workspace_member(workspace_id)` decorator which only validates membership status without enforcing role-based restrictions. This default configuration sets `min_role="member"` which allows any authenticated member to execute the deletion operation regardless of their actual role within the workspace. The absence of caller-role verification means that a regular member can target and remove users with higher privileges, including the workspace owner who holds administrative authority. Additionally, the system lacks a crucial guard mechanism to prevent removal of the last remaining owner, creating a scenario where an entire workspace could be rendered inaccessible through simple deletion operations.
The operational impact of this vulnerability is severe as it enables privilege escalation and potential complete workspace compromise. An attacker with basic member access can systematically remove all other workspace members including owners, effectively locking themselves out of legitimate administrative controls while maintaining their own access. This creates a persistent denial-of-service condition that prevents proper workspace management and could be exploited to gain unauthorized control over sensitive data and system resources. The vulnerability directly undermines the principle of least privilege and provides an attacker with a pathway to completely subvert workspace governance mechanisms.
Mitigation strategies should focus on implementing comprehensive role-based access controls that enforce both caller and target role validation before allowing member removal operations. The system must validate that the requesting user holds sufficient privileges to remove the target user, typically requiring at least owner-level permissions for such operations. Additionally, a critical guard mechanism should be implemented to prevent removal of the last workspace owner, ensuring that at least one administrator remains available to restore access if needed. The patch introduced in version 0.1.4 addresses these issues by implementing proper authorization checks that align with industry best practices for access control and privilege management. Organizations should also consider implementing audit logging for all membership modification operations to detect and respond to unauthorized removal attempts, while following ATT&CK framework recommendations for monitoring account access removal activities to maintain effective security posture.