MervinPraison PraisonAI up to 0.1.3 REST routes /api/v1/workspaces workspace_id/global UUID improper authorization

Summaryinfo

A vulnerability was found in MervinPraison PraisonAI up to 0.1.3 and classified as critical. This impacts an unknown function of the file /api/v1/workspaces of the component REST routes. Such manipulation of the argument workspace_id/global UUID leads to improper authorization. This vulnerability is uniquely identified as CVE-2026-47399. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in MervinPraison PraisonAI up to 0.1.3. Affected by this issue is an unknown code of the file /api/v1/workspaces of the component REST routes. The manipulation of the argument workspace_id/global UUID with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL. As a result, a valid member of `workspace_attacker` can call a route under `/api/v1/workspaces/{workspace_attacker}/...` while supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID. This breaks the platform's workspace isolation boundary. PraisonAI Platform version 0.1.4 patches the issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47399 since 05/19/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading to version 0.1.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MervinPraison

Name

• PraisonAI

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3

Website

• Product: https://github.com/MervinPraison/PraisonAI/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion