CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

Missing Authorization

Overview praisonai-platform is a Platform layer for PraisonAI — workspace, auth, issues, projects Affected versions of this package are vulnerable to Missing Authorization in the deleteworkspace process. An attacker can irreversibly delete all workspace data, including projects, issues, comments,...