CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
A low-privilege workspace member can escalate to owner by adding arbitrary users via the member addition endpoint, compromising workspace integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-47413?
CVE-2026-47413 is a critical vulnerability in MervinPraison praisonai-platform, published on 21 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, user_id, role)`, which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue.
Which versions are affected by CVE-2026-47413?
3 open source packages ship an affected version, including praisonai-platform.
| Package | Affected | Fixed in |
|---|---|---|
praisonai-platform PyPI | All versions | 0.1.4 |
praisonai-platform PyPI | All versions | 0.1.4 |
praisonai-platform PyPI | All versions | 0.1.4 |
How do I fix CVE-2026-47413?
Upgrade praisonai-platform to 0.1.4 or later.
Is CVE-2026-47413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-47413 exists.
Sources
Also known as GHSA-8g2p-pqm3-fcfh, PYSEC-2026-480.