CVE-2026-47413 in praisonai-platform
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, user_id, role)`, which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform vulnerability represents a critical privilege escalation flaw that undermines tenant isolation and access control mechanisms within the multi-agent teams system. This security weakness exists in versions prior to 0.1.4 and stems from improper authorization checks at the API endpoint level. The vulnerability specifically affects the POST /workspaces/{workspace_id}/members endpoint which should enforce strict role-based access controls but instead operates with minimal permission validation. The authentication mechanism relies solely on require_workspace_member(workspace_id) with a default minimum role requirement of "member", creating an exploitable gap in the security architecture.
The technical implementation flaw occurs when the system forwards request parameters directly to the MemberService.add method without performing any caller-permission verification. This direct parameter forwarding pattern constitutes a classic authorization bypass vulnerability where the application trust the client-provided user_id and role values without validating whether the requesting user has sufficient privileges to perform such operations. The absence of any authorization check in the add method allows an attacker with basic member-level access to elevate privileges by adding themselves or other users as workspace owners, completely undermining the multi-tenant security model.
This vulnerability enables severe operational impacts including cross-tenant member injection attacks that can compromise entire workspace environments. An attacker with minimal privileges can escalate their access rights to owner level within any workspace they can join, potentially gaining control over sensitive data and system configurations. The ability to inject arbitrary user accounts with elevated roles creates a persistent threat vector that could be exploited to maintain long-term access, conduct data exfiltration, or perform malicious operations across multiple tenant environments. This type of vulnerability directly violates the principle of least privilege and can lead to widespread compromise of the platform's multi-tenant architecture.
The mitigation for this vulnerability requires implementing proper authorization checks within the MemberService.add method to verify that the calling user has sufficient privileges before allowing member addition operations. The fix should ensure that only users with owner or administrator roles can add other users with elevated permissions, and that any privilege escalation attempts are properly validated against the caller's current role. This issue aligns with CWE-285 which addresses improper authorization in software systems, and maps to ATT&CK technique T1078 which covers valid accounts and legitimate credentials for persistent access. The patch implemented in version 0.1.4 demonstrates the correct approach of enforcing granular access controls and implementing proper permission validation mechanisms. Organizations should also consider implementing additional monitoring and alerting for unauthorized privilege escalation attempts, as well as conducting regular security assessments to identify similar authorization bypass vulnerabilities in their multi-tenant applications.