CVE-2026-47419 in praisonai-platform
Summary
by MITRE • 07/21/2026
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `agent_id` through `AgentService.get(agent_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete agents that belong to a different workspace `W2` by guessing or harvesting an agent UUID and calling `…/workspaces/W1/agents/<W2-agent-id>`. PraisonAI Platform version 0.1.4 patches the issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The PraisonAI Platform vulnerability represents a critical Insecure Direct Object Reference flaw that undermines the system's access control mechanisms. This weakness exists within the agent management endpoints that handle Create, Read, Update, and Delete operations for multi-agent teams. The vulnerability stems from a fundamental design flaw where the platform validates workspace membership only at the initial endpoint level but fails to enforce workspace boundaries during the actual object retrieval process. When a user attempts to access an agent through the CRUD endpoints, the system correctly verifies that the user belongs to the specified workspace but then proceeds to fetch the agent using a direct database lookup based solely on the agent identifier without cross-checking workspace ownership.
The technical implementation of this vulnerability allows for cross-workspace data leakage and unauthorized manipulation of resources. The authentication mechanism correctly enforces `require_workspace_member(workspace_id)` which ensures that users are members of the target workspace before proceeding with operations. However, the subsequent `AgentService.get(agent_id)` call performs a primary-key lookup that bypasses any workspace context validation, effectively allowing attackers to access objects from different workspaces by simply knowing or guessing valid object identifiers. This creates a scenario where a malicious user in workspace W1 can perform read, modify, or delete operations on agents belonging to workspace W2 by crafting requests with the target workspace identifier while using the victim workspace's agent UUID.
This vulnerability directly maps to CWE-284, which describes Insecure Direct Object Reference issues where applications fail to properly verify that the user is authorized to access specific objects. The operational impact extends beyond simple data exposure as it enables privilege escalation and potential lateral movement within the platform's multi-agent architecture. An attacker could systematically enumerate agent identifiers across workspaces, potentially gaining access to sensitive configurations, agent behaviors, or operational data belonging to other users' teams. The vulnerability also poses significant risks to data integrity since unauthorized modifications to agents could disrupt team operations or enable attackers to inject malicious behavior into other workspaces.
The security implications of this flaw are particularly severe in multi-tenant environments where workspace isolation is crucial for maintaining data privacy and operational security. The platform's architecture should enforce strict object-level access controls that maintain workspace boundaries throughout all operations, ensuring that a user's access rights extend only to objects within their designated workspaces. This type of vulnerability demonstrates the critical importance of implementing proper authorization checks at every level of an application's data access layer, as bypassing initial validation with direct object references can lead to complete compromise of multi-tenant security models. The fix implemented in version 0.1.4 addresses this by enforcing workspace constraints during the agent retrieval process, ensuring that all object access operations validate both user membership and object ownership within the same workspace context.
Mitigation strategies should include comprehensive code review of all direct object references to ensure proper authorization checks are enforced at every data access point. The platform architecture must implement a consistent pattern where object-level access controls verify both user permissions and object ownership before performing any operations. Security testing should include extensive validation of access control boundaries, particularly focusing on scenarios where users attempt to access objects across workspace contexts. Additionally, implementing automated monitoring for unauthorized cross-workspace access attempts can help detect potential exploitation attempts and provide early warning of security breaches. Organizations using PraisonAI platforms should conduct immediate assessments of their deployment configurations to ensure proper patching and validate that all workspace isolation mechanisms are functioning correctly.
The vulnerability exemplifies common patterns found in multi-tenant applications where insufficient object-level authorization enforcement creates opportunities for privilege escalation. This aligns with ATT&CK tactic T1078 which covers valid accounts and T1531 which addresses credential access through application vulnerabilities. The incident highlights the necessity of robust input validation and proper access control implementation, particularly when dealing with multi-tenant architectures where workspace boundaries must be strictly enforced at all levels of system operation to maintain security isolation between different user groups and their respective data assets.