CVE-2026-47412 in praisonai-platform
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. PraisonAI Platform version 0.1.4 patches the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform authorization bypass vulnerability represents a critical security flaw that undermines the fundamental access control mechanisms of the multi-agent teams system. This vulnerability exists in versions prior to 0.1.4 and stems from improper privilege validation within the workspace deletion endpoint, specifically the `DELETE /workspaces/{workspace_id}` route. The flaw demonstrates a clear violation of the principle of least privilege, where the authorization check only verifies membership status without considering role hierarchy or implementing proper administrative safeguards.
The technical implementation of this vulnerability lies in the insufficient access control validation that relies solely on `require_workspace_member(workspace_id)` with a default minimum role requirement of "member". This design pattern creates a dangerous escalation path where any workspace member can execute destructive operations that should be restricted to administrators or owners. The absence of owner-role specific gates, confirmation tokens, or any form of administrative approval mechanism allows unauthorized deletion of entire workspace contents including projects, issues, comments, agents, labels, and member records.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on PraisonAI Platform for collaborative development environments. A malicious or compromised workspace member can completely obliterate an entire workspace through a single DELETE request, resulting in irreversible data loss without any recovery options. The cascading deletion behavior via foreign-key relationships amplifies the damage, as the deletion of one entity triggers automatic removal of related records throughout the system. This vulnerability directly violates security best practices outlined in the OWASP Top Ten and aligns with CWE-285, which addresses improper authorization in security-sensitive functions.
The lack of protective measures including soft-delete windows, recovery paths, or confirmation mechanisms creates a particularly dangerous scenario where users can accidentally or intentionally destroy valuable data without any mitigation options. The vulnerability represents a classic example of inadequate input validation and access control implementation that could be exploited through various attack vectors including social engineering, credential compromise, or insider threats. Organizations using affected versions should immediately implement the patch released in version 0.1.4 which addresses this authorization bypass by implementing proper role-based access controls and administrative safeguards.
This vulnerability demonstrates the importance of implementing multi-layered security controls including proper authentication checks, authorization validation, and data protection mechanisms. The fix implemented in version 0.1.4 should include robust owner-role verification, confirmation prompts for destructive operations, and recovery mechanisms to prevent accidental or malicious data loss. Organizations should conduct thorough security assessments of their PraisonAI Platform deployments to ensure all instances have been updated to the patched version and that proper access control policies are enforced across workspace members with appropriate role assignments and administrative privileges.