CVE-2026-47405: PraisonAI Privilege Escalation Flaw

CVE-2026-47405 Overview

CVE-2026-47405 is a broken access control vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 expose privileged workspace-management routes through the shared require_workspace_member(...) dependency, which defaults to min_role="member". Any authenticated low-privilege workspace member can invoke administrative endpoints and promote their own account to owner. The flaw enables vertical privilege escalation, arbitrary role changes, removal of legitimate owners, and destructive workspace operations. PraisonAI Platform version 0.1.4 patches the issue.

Critical Impact
An authenticated workspace member can escalate to owner, take over workspace membership, remove legitimate owners, and perform destructive operations across the workspace.

Affected Products

PraisonAI Platform versions prior to 0.1.4
PraisonAI multi-agent teams system workspace management API
Deployments exposing PraisonAI Platform routes to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-47405 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47405

Vulnerability Analysis

The vulnerability stems from improper access control [CWE-284] in PraisonAI Platform's FastAPI route dependencies. Workspace-management routes that should require elevated privileges instead reuse the general require_workspace_member(...) dependency. This dependency defaults to min_role="member", so any authenticated member of a workspace passes the check.

As a result, endpoints intended for administrators and owners accept requests from ordinary members. Attackers can promote themselves from member to owner, add arbitrary users as owner or admin, change other members' roles, and remove existing owners. After escalation, the attacker can execute destructive workspace operations and effectively take over workspace membership.

Root Cause

The root cause is a missing role constraint on privileged routes. The shared dependency does not enforce admin or owner on administrative operations, and the default min_role value is not overridden per route. This is a classic vertical privilege escalation caused by broken function-level authorization.

Attack Vector

Exploitation requires only authenticated access as a low-privilege workspace member. The attacker sends HTTP requests to workspace-management endpoints (for example, role assignment routes) with a payload elevating their own membership to owner. No user interaction is required, and the attack is executed over the network.

python

# Security patch excerpt from src/praisonai-platform/praisonai_platform/api/routes/agents.py
# Source: https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47

from praisonaiagents.auth import AuthIdentity

-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService

The patch pull request GitHub PR #1686 tightens dependency usage across workspace routes so that administrative endpoints require the appropriate role.

Detection Methods for CVE-2026-47405

Indicators of Compromise

Audit log entries showing a workspace member's role changing from member to owner without administrator action.
Unexpected addition of new owner or admin accounts to a workspace by a non-privileged actor.
Removal or demotion of legitimate owner accounts by an account that previously held member role.
HTTP requests to workspace role-management endpoints originating from accounts that were never granted administrative privileges.

Detection Strategies

Review PraisonAI Platform access logs for role-change API calls correlated with the acting user's prior role.
Diff current workspace membership against known-good baselines to identify unauthorized owner/admin promotions.
Alert when the same authenticated identity performs a self-role modification followed by additional privileged actions.

Monitoring Recommendations

Enable request-level audit logging for all /workspaces/* routes, including actor identity, target user, and role transitions.
Forward PraisonAI Platform logs to a centralized SIEM and build detections for role escalation patterns.
Monitor for bulk membership changes or owner removals occurring in short time windows.

How to Mitigate CVE-2026-47405

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later without delay.
Audit every workspace for unauthorized owner and admin accounts and revoke any suspicious membership changes.
Rotate API tokens and session credentials for any workspace where unexpected role changes are observed.
Restrict network exposure of the PraisonAI Platform API to trusted networks until patching is complete.

Patch Information

PraisonAI Platform version 0.1.4 fixes the issue by ensuring privileged routes no longer rely on the default min_role="member". Details are published in GitHub Security Advisory GHSA-h37g-4h4p-9x97, with the code change in this GitHub commit and GitHub Pull Request #1686.

Workarounds

If immediate upgrade is not possible, restrict PraisonAI Platform access to a small set of trusted administrators via network controls or authentication proxy.
Temporarily disable self-service workspace invitations so that no untrusted user obtains even member role.
Apply the upstream patch manually by overriding require_workspace_member calls on administrative routes to enforce min_role="admin" or min_role="owner".

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai-platform>=0.1.4"

# Verify installed version
python -c "import praisonai_platform, importlib.metadata as m; print(m.version('praisonai-platform'))"

# Optional: bind the platform to localhost only, matching the hardened default in 0.1.4
export PLATFORM_HOST=127.0.0.1
praisonai-platform --host "$PLATFORM_HOST" --port 8000