CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

WePay: Invited users can modify and/or remove account owner

Summary -------------- If an invited user in an account has "can modify" privileges, he can modify the privileges of the owner of the account or even just completely remove him. Steps to reproduce -------------- 1. Create an account and got to...