CVE-2026-47407: PraisonAI Privilege Escalation Flaw

CVE-2026-47407 Overview

CVE-2026-47407 is a critical authorization flaw in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to validate that resources referenced in URL paths actually belong to the workspace specified in the URL prefix. Any authenticated member of any workspace can read, update, or delete resources across all tenants. A second flaw permits basic members to promote themselves to admin or owner, remove other members, and delete workspaces. Registration is open with no email verification, and the server binds to 0.0.0.0:8000 by default. The vulnerability is tracked as [CWE-269: Improper Privilege Management].

Critical Impact
A single unauthenticated request from any network position can register an account, bootstrap into the system, access cross-tenant resources, and seize administrative control of arbitrary workspaces.

Affected Products

PraisonAI Platform versions prior to 0.1.4
FastAPI route handlers under /api/v1/workspaces/{workspace_id}/...
Member-management routes including add_member, update_member_role, remove_member, update_workspace, and delete_workspace

Discovery Timeline

2026-07-21 - CVE-2026-47407 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47407

Vulnerability Analysis

The PraisonAI Platform exposes tenant resources through URLs of the form /api/v1/workspaces/{workspace_id}/.... Each route relies on the require_workspace_member(workspace_id) FastAPI dependency for authorization. This dependency validates only that the caller belongs to the workspace named in the URL prefix. Route handlers then fetch the inner resource, such as agent_id, issue_id, project_id, label_id, comment_id, or dependency_id, by primary key alone. The resource's own workspace_id field is never compared against the URL prefix, enabling cross-tenant access to any resource whose ID the attacker can guess or enumerate.

The second flaw affects member-management routes. Each inherits the default min_role="member" from require_workspace_member. The role hierarchy exists in the schema but is not enforced at the handler level.

Root Cause

Authorization logic is incomplete. The dependency checks membership against the URL prefix workspace, but handlers never verify that the referenced resource belongs to that workspace. Member-management endpoints also fail to enforce the role hierarchy, treating member as sufficient for owner-level operations.

Attack Vector

An attacker registers an account through the open /api/v1/auth/register endpoint with no email verification. They create a workspace, becoming its owner. They then issue requests where the URL prefix references their own workspace but the path parameter references a resource ID in a victim workspace. The membership check passes, and the handler returns, modifies, or deletes the victim's resource. The same primitive allows self-promotion to admin or owner in any workspace by targeting member-management routes.

python

# Patch excerpt from src/praisonai-platform/praisonai_platform/api/routes/agents.py
# The vulnerable helper ensure_resource_in_workspace was reintroduced across
# route handlers to validate the inner resource against the URL workspace_id.
from praisonaiagents.auth import AuthIdentity

-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService
# Source: https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47

Detection Methods for CVE-2026-47407

Indicators of Compromise

HTTP requests to /api/v1/workspaces/{workspace_id}/... where the resource ID in the path does not belong to the workspace referenced in the prefix.
New account registrations at /api/v1/auth/register from unexpected IP ranges immediately followed by workspace creation.
PATCH requests to update_member_role where the requesting user's current role is member but the target role is admin or owner.
PraisonAI Platform servers bound to 0.0.0.0:8000 and reachable from untrusted networks.

Detection Strategies

Correlate application logs to flag any request where the authenticated caller is not a member of the resource's canonical workspace.
Alert on rapid sequences of register → create workspace → cross-workspace resource access from a single client.
Baseline role transitions and alert on privilege elevation events that lack an approving administrator identity.

Monitoring Recommendations

Ingest FastAPI access logs into a centralized logging pipeline and enrich each event with the resource's actual workspace_id.
Monitor for enumeration behavior against integer or UUID resource IDs across workspace boundaries.
Track network exposure of PraisonAI Platform instances on TCP 8000 and confirm they are not reachable from the public internet.

How to Mitigate CVE-2026-47407

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4, which patches the authorization checks and changes the default bind address.
Restrict network exposure of the platform to trusted internal networks or place it behind an authenticated reverse proxy.
Audit workspace membership, roles, and recently created accounts for unauthorized privilege changes.
Rotate credentials and API tokens for any workspace whose data may have been accessed.

Patch Information

The fix is available in PraisonAI Platform 0.1.4. See the GitHub Security Advisory GHSA-h8q5-cp56-rr65, Pull Request #1686, and the remediation commit. The patch enforces resource-to-workspace validation in route handlers and changes the default bind to 127.0.0.1, configurable through the PLATFORM_HOST environment variable.

Workarounds

Block external access to TCP 8000 with host or network firewall rules until the upgrade is applied.
Disable open registration by placing an authenticating reverse proxy in front of /api/v1/auth/register.
Manually bind the service to 127.0.0.1 using the --host argument and expose it only through an authenticated gateway.

bash

# Bind PraisonAI Platform to loopback and require an environment override for external access
export PLATFORM_HOST=127.0.0.1
python -m praisonai_platform --host 127.0.0.1 --port 8000

# Restrict inbound traffic to the platform port
sudo iptables -A INPUT -p tcp --dport 8000 ! -s 127.0.0.1 -j DROP