CVE-2026-47414

🗓️ 21 Jul 2026 17:11:36Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 35 Views🌐 WEB

CVE-2026-47414: PraisonAI Platform before 0.1.4 permits cross-workspace label edits and issue links without ownership checks.

Reporter	Title	Published	Views	Family All 12
ATTACKERKB	CVE-2026-47414	21 Jul 202617:11	–	attackerkb
Cvelist	CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR	21 Jul 202617:11	–	cvelist
EUVD	EUVD-2026-46332	21 Jul 202617:11	–	euvd
Github Security Blog	praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	29 May 202622:51	–	github
NVD	CVE-2026-47414	21 Jul 202618:17	–	nvd
OSV	GHSA-5JX9-W35F-VP65 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	29 May 202622:51	–	osv
OSV	PYSEC-2026-2929 praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	13 Jul 202615:35	–	osv
Positive Technologies	PT-2026-45065	29 May 202600:00	–	ptsecurity
Positive Technologies	PT-2026-59561	13 Jul 202600:00	–	ptsecurity
PyPA	praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)	13 Jul 202615:35	–	pypa

Vulners

Node

mervinpraison praisonai-platformRange<0.1.4

[
  {
    "vendor": "MervinPraison",
    "product": "praisonai-platform",
    "versions": [
      {
        "version": "< 0.1.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619
github	www.github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jx9-w35f-vp65
github	www.github.com/MervinPraison/PraisonAI/pull/1685

Parameter	Position	Path	Description	CWE
workspace_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized access to or modification of labels.	CWE-639
label_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized access to or modification of labels.	CWE-639
workspace_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized access to or modification of labels.	CWE-639
label_id	path	/workspaces/{workspace_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized access to or modification of labels.	CWE-639
issue_id	path	/issues/{issue_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized association of labels to issues.	CWE-639
label_id	path	/issues/{issue_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized association of labels to issues.	CWE-639
issue_id	path	/issues/{issue_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized removal of labels from issues.	CWE-639
label_id	path	/issues/{issue_id}/labels/{label_id}	Insecure Direct Object Reference via path parameters could allow unauthorized removal of labels from issues.	CWE-639
issue_id	path	/issues/{issue_id}/labels	Insecure Direct Object Reference via path parameter could allow enumeration or manipulation of issue-label mappings.	CWE-639

23 Jul 2026 15:17Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.17.6

EPSS0.00215

SSVC

CWE-639