CVE-2026-47419

CVE-2026-47419 concerns PraisonAI Platform where agent endpoints under /workspaces/{workspace_id}/agents/{agent_id} suffer an Insecure Direct Object Reference. The description and connected reports show that endpoints gate access with require_workspace_member(workspace_id) but the AgentService.ge...

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47406

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

CVE-2026-47415

Summary: Multiple sources document a cross-workspace IDOR in PraisonAI Platform (CVE-2026-47415). The Issue endpoints under /workspaces/{workspace_id}/issues/{issue_id} rely on a membership check for the workspace but do not constrain the retrieved issue by the same workspace, allowing a member o...

CVE-2026-47415 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/issues/issueid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47414

CVE-2026-47414 – cross-workspace IDOR in PraisonAI Label endpoints Technical details across Connected documents show concrete flaws in PraisonAI Platform up to version 0.1.3 (older than 0.1.4): five label-related endpoints allow arbitrary label_id/issue_id values to be used without verifying work...

CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47406

PraisonAI Platform has a documented IDOR flaw in its dependency endpoints. Versions before 0.1.4 allow cross-workspace linkage, read, and deletion of dependencies because URL and body IDs (workspace_id, issue_id, dep_id, and body.depends_on_issue_id) are not workspace-validated before DependencyS...

CVE-2026-28313

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments...

CVE-2026-28305

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments...

CVE-2026-28302

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments...

CVE-2026-28317

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation, requiring domain administrator access with impact higher on non-Windows deployments. The issue is described across CVE-2026-28317 records (NVD and CVE List) as an IDOR ...

EUVD-2026-46298

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments...

CVE-2026-28316

SolarWinds Serv-U has an IDOR vulnerability (CVE-2026-28316) that can escalate privileges to a system administrator with the ability to run commands as root. A domain account with administrator access is required. The impact is noted as lower in Windows deployments. The connected documents provid...

EUVD-2026-46296

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in...

EUVD-2026-46294

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments...

EUVD-2026-46289

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments...