MervinPraison praisonai-platform up to 0.1.3 Labels require_workspace_member label_id/issue_id resource injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in MervinPraison praisonai-platform up to 0.1.3. Affected by this issue is the function require_workspace_member of the component Labels. Performing a manipulation of the argument label_id/issue_id results in resource injection. This vulnerability is reported as CVE-2026-47414. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in MervinPraison praisonai-platform up to 0.1.3. This affects the function require_workspace_member of the component Labels. The manipulation of the argument label_id/issue_id with an unknown input leads to a resource injection vulnerability. CWE is classifying the issue as CWE-99. The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — `PATCH /workspaces/{workspace_id}/labels/{label_id}`, `DELETE .../labels/{label_id}`, `POST .../issues/{issue_id}/labels/{label_id}`, `DELETE .../issues/{issue_id}/labels/{label_id}`, `GET .../issues/{issue_id}/labels` — gate access on `require_workspace_member(workspace_id)` only and pass URL-supplied `label_id` and `issue_id` straight through to `LabelService` without verifying either belongs to the workspace. PraisonAI Platform version 0.1.4 patches the issue.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-47414 since 05/19/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available.

Upgrading to version 0.1.4 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• MervinPraison

Name

• praisonai-platform

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion