CVE-2026-47414

🗓️ 21 Jul 2026 17:11:36Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 100 Views🌐 WEB

CVE-2026-47414: PraisonAI Platform before 0.1.4 permits cross-workspace label edits and issue links without ownership checks.

Reporter	Title	Published	Views	Family All 14
attackerkb	CVE-2026-47414	21 Jul 202617:11	–	attackerkb
Cvelist	CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR	21 Jul 202617:11	–	cvelist
EUVD	EUVD-2026-46332	21 Jul 202617:11	–	euvd
Github Security Blog	praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	29 May 202622:51	–	github
Mend	CVE-2026-47414	21 Jul 202617:11	–	mend
NVD	CVE-2026-47414	21 Jul 202618:17	–	nvd
osv_ghsa	GHSA-5JX9-W35F-VP65 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	29 May 202622:51	–	osv_ghsa
osv_pysec	PYSEC-2026-2929 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	13 Jul 202615:35	–	osv_pysec
Positive Technologies	PT-2026-45065	29 May 202600:00	–	ptsecurity
Positive Technologies	PT-2026-59561	13 Jul 202600:00	–	ptsecurity

Vulners

Node

praison praisonaiRange<0.1.4

[
  {
    "vendor": "MervinPraison",
    "product": "praisonai-platform",
    "versions": [
      {
        "version": "< 0.1.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jx9-w35f-vp65
github	www.github.com/MervinPraison/PraisonAI/pull/1685
github	www.github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619

Parameter	Position	Path	Description	CWE
workspace_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference (IDOR) in the label management endpoint where label_id is not verified against the workspace_id.	CWE-639
label_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference (IDOR) in the label management endpoint where label_id is not verified against the workspace_id.	CWE-639
workspace_id	path	/workspaces/{workspace_id}/labels/{label_id}	DELETE request for labels is vulnerable to IDOR as label_id is not verified against the workspace_id.	CWE-639
label_id	path	/workspaces/{workspace_id}/labels/{label_id}	DELETE request for labels is vulnerable to IDOR as label_id is not verified against the workspace_id.	CWE-639
workspace_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	POST request to add labels to issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639
issue_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	POST request to add labels to issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639
label_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	POST request to add labels to issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639
workspace_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	DELETE request to remove labels from issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639
issue_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	DELETE request to remove labels from issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639
label_id	path	/workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}	DELETE request to remove labels from issues is vulnerable to IDOR as issue_id and label_id are not verified against the workspace_id.	CWE-639

24 Oct 2026 19:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.6

EPSS0.00384

SSVC

CWE-639