Lucene search
+L

4686 matches found

NVD
NVD
added 2026/07/21 6:17 p.m.8 views

CVE-2026-47414

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

7.6CVSS0.00215EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 6:16 p.m.7 views

CVE-2026-47412

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

8.1CVSS0.00284EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/21 5:31 p.m.32 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

8.3CVSS0.00296EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/21 5:31 p.m.5 views

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

8.3CVSS5.5AI score
SaveExploits0References4
CVE
CVE
added 2026/07/21 5:31 p.m.37 views

CVE-2026-47419

CVE-2026-47419 concerns PraisonAI Platform where agent endpoints under /workspaces/{workspace_id}/agents/{agent_id} suffer an Insecure Direct Object Reference. The description and connected reports show that endpoints gate access with require_workspace_member(workspace_id) but the AgentService.ge...

8.3CVSS5.4AI score0.00296EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/21 5:26 p.m.28 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

8.1CVSS0.00289EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/21 5:26 p.m.5 views

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

8.1CVSS5.6AI score
SaveExploits0References5
CVE
CVE
added 2026/07/21 5:26 p.m.38 views

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

8.1CVSS5.5AI score0.00289EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/21 5:24 p.m.32 views

CVE-2026-47417

Summary of vulnerability (CVE-2026-47417, PraisonAI Platform) : The comment endpoints POST /workspaces/{workspace_id}/issues/{issue_id}/comments and GET /workspaces/{workspace_id}/issues/{issue_id}/comments are gated by require_workspace_member only on the workspace, but the code paths do not ver...

8.1CVSS5.4AI score0.00209EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/21 5:24 p.m.28 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid...

8.1CVSS0.00209EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/21 5:24 p.m.4 views

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid...

8.1CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/21 5:19 p.m.30 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member"...

9.6CVSS0.00209EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/21 5:19 p.m.5 views

CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The PATCH /workspaces/workspaceid/members/userid endpoint is gated by requireworkspacememberworkspaceid, which defaults to minrole="member"...

9.6CVSS5.4AI score
SaveExploits0References4
NVD
NVD
added 2026/07/21 5:17 p.m.5 views

CVE-2026-47406

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The dependency endpoints POST/GET /workspaces/workspaceid/issues/issueid/dependencies and DELETE .../dependencies/depid gate access on...

8.1CVSS0.00231EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.8 views

CVE-2026-47405

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged...

8.8CVSS0.0029EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.8 views

CVE-2026-47407

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/workspaceid/... and protects them with a requireworkspacememberworkspaceid FastAPI dependency. The dependency only checks tha...

9.4CVSS0.00238EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.7 views

CVE-2026-47409

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

8.1CVSS0.00284EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.9 views

CVE-2026-47408

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

6.5CVSS0.00231EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.7 views

CVE-2026-47399

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to...

8.8CVSS0.0029EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/21 5:17 p.m.8 views

CVE-2026-15342

Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate assets belonging to another workspace by providing only the victim workspace slug and asset ID. The affected endpoints return presigned...

6.5CVSS0.00225EPSS
SaveExploits0References3
Rows per page
Query Builder