CVE-2026-47415 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/issues/issueid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/workspaceid/labels/labelid, DELETE .../labels/labelid, POST .../issues/issueid/labels/labelid, DELETE...

CVE-2026-47414

CVE-2026-47414 – cross-workspace IDOR in PraisonAI Label endpoints Technical details across Connected documents show concrete flaws in PraisonAI Platform up to version 0.1.3 (older than 0.1.4): five label-related endpoints allow arbitrary label_id/issue_id values to be used without verifying work...

CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...

CVE-2026-47413

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...

CVE-2026-47413

Pra sisAI Platform (versions before 0.1.4) is vulnerable to privilege escalation via POST /workspaces/{workspace_id}/members. The endpoint is gated by require_workspace_member (default min_role=member) but forwards body.user_id and body.role directly to MemberService.add(), which does not perform...

CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

CVE-2026-47412

CVE-2026-47412 describes an authorization bypass in PraisonAI Platform: versions prior to 0.1.4 allow any workspace member to delete the entire workspace via DELETE /workspaces/{workspace_id}, because the endpoint is gated only by require_workspace_member with a default min_role of member. The im...

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default...

CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The PATCH /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default...

CVE-2026-47411

PraisonAI Platform contains an authorization bypass in PATCH /workspaces/{workspace_id}: endpoints guarded by require_workspace_member (default min_role=member) allow any workspace member to rewrite workspace name, description, and the free‑form settings JSON. This can enable configuration inject...

CVE-2026-47409

CVE-2026-47409 affects PraisonAI Platform. Public docs confirm an authorization bypass in DELETE /workspaces/{workspace_id}/members/{user_id}: any workspace member can remove any other member (including the owner) because require_workspace_member defaults to min_role=member and lacks caller/targe...

EUVD-2026-46323

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The DELETE /workspaces/workspaceid/members/userid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member"...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...

CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The GET /workspaces/workspaceid/issues/issueid/activity endpoint is gated by requireworkspacememberworkspaceid and dispatches to...