CVE-2026-47417

creationtimestamp| type| source ---|---|--- 2026-07-21 19:54:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6lmboszb2j...

CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints POST /workspaces/workspaceid/issues/issueid/comments and GET .../comments gate access on requireworkspacememberworkspaceid...