CVE-2026-47411 in PraisonAI Platform
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform authorization bypass vulnerability represents a critical access control flaw that undermines the security posture of the multi-agent teams system. This vulnerability exists in versions prior to 0.1.4 and specifically targets the workspace management functionality through the PATCH /workspaces/{workspace_id} endpoint. The flaw stems from inadequate permission validation where the authorization check only verifies membership status without enforcing proper role-based access controls. The system's default minimum role requirement of "member" creates an unintended pathway for privilege escalation, allowing any authenticated workspace member to manipulate critical workspace metadata and configuration settings.
The technical implementation of this vulnerability manifests through the insufficient authorization mechanism that fails to distinguish between different user roles when processing workspace modification requests. The endpoint require_workspace_member(workspace_id) function provides only basic membership verification rather than comprehensive role validation, enabling unauthorized modifications to workspace attributes including name, description, and the sensitive settings JSON blob. This design flaw creates a configuration injection primitive that can be exploited across the entire platform's configurable parameters, as the settings field accepts arbitrary JSON objects that are subsequently processed by downstream components.
The operational impact of this vulnerability extends beyond simple data modification to potentially compromise the entire platform's security model. Any workspace member can alter the settings field which serves as a conduit for configuration injection attacks, enabling attackers to modify system behaviors, access controls, and operational parameters that may affect other users or system functions. This creates an environment where malicious actors can manipulate platform configurations to gain unauthorized access to resources, disrupt operations, or establish persistent backdoors within the multi-agent ecosystem. The free-form nature of the settings JSON object amplifies this risk by providing multiple attack vectors through which various platform components could be compromised.
This vulnerability aligns with CWE-285, which addresses improper authorization issues in software systems, and represents a classic case of insufficient access control validation. From an adversarial perspective, this flaw maps to ATT&CK technique T1078.004 for valid accounts and T1566.002 for phising, as attackers could leverage compromised member accounts to escalate privileges and modify platform configurations. The patch implemented in version 0.1.4 likely addresses the authorization bypass by strengthening role validation mechanisms and ensuring that workspace modification operations require appropriate administrative or owner permissions rather than simply membership status. Organizations using PraisonAI Platform should immediately upgrade to version 0.1.4 or later to mitigate this risk, while also implementing monitoring for unauthorized workspace modifications and conducting thorough security assessments of platform configurations that may have been tampered with through this vulnerability.