CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Attackers can access cross-tenant resources and escalate privileges to admin due to missing authorization checks in PraisonAI Platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47407?
CVE-2026-47407 is a critical missing authorization vulnerability in MervinPraison praisonai-platform, published on 21 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.
Which versions are affected by CVE-2026-47407?
3 open source packages ship an affected version, including praisonai-platform.
| Package | Affected | Fixed in |
|---|---|---|
praisonai-platform PyPI | All versions | 0.1.4 |
praisonai-platform PyPI | All versions | 0.1.4 |
praisonai-platform PyPI | All versions | 0.1.4 |
How do I fix CVE-2026-47407?
Upgrade praisonai-platform to 0.1.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-47407 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47407 exists.
Sources
Also known as GHSA-h8q5-cp56-rr65, PYSEC-2026-482.