CVE-2026-47415: Authorization Bypass Through User-Controlled Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/issues/issueid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47414: Authorization Bypass Through User-Controlled Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

CVE-2026-47410: Use of Hard-coded Cryptographic Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...

CVE-2026-47409: Improper Privilege Management

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

CVE-2026-47408: Authorization Bypass Through User-Controlled Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47407: Improper Privilege Management

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

CVE-2026-47399: Improper Access Control

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

CVE-2026-47398: Improper Control of Generation of Code

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj added the PRAISONAIALLOWLOCALTOOLS env-var gate to the tooloverride.py sinks. However, two additional spec.loader.execmodule call sites in praisonai/agentsgenerator.py were...

CVE-2026-47397: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

CVE-2026-47406: Authorization Bypass Through User-Controlled Key

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

CVE-2026-56840

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:58+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-63v4-w882-g4x2 2026-10-23 12:19:25+00:00| seen| https://infosec.exchange/users/cve/statuses/117490186021848225...

CVE-2026-56832

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:19+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8579-rgg5-ph2m 2026-10-23 12:14:43+00:00| seen| https://infosec.exchange/users/cve/statuses/117490167491895137...

CVE-2026-56834

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:15+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-j7qx-p75m-wp7g 2026-10-23 12:16:04+00:00| seen| https://infosec.exchange/users/cve/statuses/117490172807382432...

CVE-2026-56837

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:06+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-fc26-m9pf-v56q 2026-10-23 12:18:05+00:00| seen| https://infosec.exchange/users/cve/statuses/117490180723012023...

CVE-2026-56839

creationtimestamp| type| source ---|---|--- 2026-07-20 22:37:02+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gcq3-mfvh-3x25...

CVE-2026-57112

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:59+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vmf9-xx9w-86wx...

CVE-2026-57115

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h9p-93hq-q7h6...

CVE-2026-57114

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:41+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rjvw-7vvw-549v 2026-10-23 12:34:54+00:00| seen| https://infosec.exchange/users/cve/statuses/117490246859126549...

CVE-2026-57124

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:31+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-p75f-6fp4-p57w 2026-07-23 17:02:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrdcvkwlge2r 2026-09-14...

CVE-2026-57126

creationtimestamp| type| source ---|---|--- 2026-07-20 22:36:26+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vxgj-xg5c-p4h7 2026-09-14 16:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mvii6rhrqp2p 2026-09-14...