CVE-2026-47408 Overview
CVE-2026-47408 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 expose issue activity logs across tenant boundaries. The GET /workspaces/{workspace_id}/issues/{issue_id}/activity endpoint validates workspace membership but then queries activity records using only issue_id, ignoring the workspace scope. Any authenticated user belonging to a single workspace can read the full activity history of any issue in the entire multi-tenant deployment. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Authenticated tenants can read activity logs of any issue across all workspaces, breaking multi-tenant isolation and exposing potentially sensitive project data.
Affected Products
- PraisonAI Platform versions prior to 0.1.4
- Multi-tenant PraisonAI Platform deployments exposing the workspace issue activity API
- PraisonAI multi-agent teams systems built on the affected platform layer
Discovery Timeline
- 2026-07-21 - CVE-2026-47408 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-47408
Vulnerability Analysis
The vulnerability resides in the activity retrieval flow for workspace issues. The route handler GET /workspaces/{workspace_id}/issues/{issue_id}/activity applies the require_workspace_member(workspace_id) guard, which confirms the caller belongs to the workspace specified in the URL. The handler then delegates to ActivityService.list_for_issue(issue_id), which executes SELECT * FROM activity WHERE issue_id = :issue_id without joining or filtering on the workspace. Because the issue_id is user-supplied and the query has no tenant constraint, membership in any workspace grants read access to any issue's activity records anywhere in the deployment.
Root Cause
The root cause is a missing authorization check between the routing layer and the data access layer. The membership guard validates the caller against workspace_id, but the service layer never confirms that issue_id belongs to that workspace. This separation of authentication scope from data scope is a classic IDOR pattern where the object identifier is trusted without ownership verification.
Attack Vector
An attacker only needs authenticated access as a member of any single workspace. The attacker iterates or guesses issue_id values and issues them against a workspace_id they legitimately belong to. Because the query filters solely on issue_id, the response returns activity records for issues that reside in other tenants' workspaces. No privilege escalation or additional token is required beyond a normal user session.
// Vulnerable request pattern (conceptual)
GET /workspaces/<attacker_workspace_id>/issues/<victim_issue_id>/activity
Authorization: Bearer <attacker_session_token>
// Server-side query executed (no workspace filter):
// SELECT * FROM activity WHERE issue_id = :issue_id
See the GitHub Security Advisory GHSA-27p4-pjqv-whgj and Pull Request #1685 for technical details.
Detection Methods for CVE-2026-47408
Indicators of Compromise
- Requests to /workspaces/{workspace_id}/issues/{issue_id}/activity where the issue_id does not belong to the referenced workspace_id.
- A single user session enumerating sequential or high-volume issue_id values across a small set of workspace_id values.
- Application logs showing ActivityService.list_for_issue calls returning records for issues absent from the caller's workspace membership.
Detection Strategies
- Correlate authenticated API calls with the caller's workspace membership and flag activity endpoint responses containing issue_id values not owned by the caller's workspace.
- Deploy anomaly detection on the activity endpoint that baselines normal issue access patterns per user and alerts on broad issue_id fan-out.
- Review historical access logs for the affected endpoint since deployment of any pre-0.1.4 version to identify prior cross-tenant reads.
Monitoring Recommendations
- Enable verbose access logging on all /workspaces/*/issues/*/activity requests with source identity, workspace_id, and issue_id fields.
- Forward PraisonAI Platform application logs into a centralized SIEM to correlate authorization decisions with database query scope.
- Alert on 200-status responses to the activity endpoint where the returned records reference workspaces different from the URL path parameter.
How to Mitigate CVE-2026-47408
Immediate Actions Required
- Upgrade PraisonAI Platform to version 0.1.4 or later, which patches the missing workspace constraint.
- Audit historical logs of the affected endpoint to identify any cross-tenant data access prior to patching.
- Rotate any secrets, tokens, or sensitive references that may have been disclosed through issue activity records.
- Notify affected tenants if evidence of unauthorized cross-workspace activity reads is discovered.
Patch Information
PraisonAI Platform version 0.1.4 fixes the flaw by scoping the activity query to the workspace referenced in the route. The fix is delivered in commit ef79b7a0561796ad9807f0f09538c25cc78d3619 and merged via Pull Request #1685. Administrators should upgrade directly to 0.1.4 or newer.
Workarounds
- If immediate patching is not possible, restrict access to the activity endpoint at the reverse proxy or API gateway layer until upgrade.
- Add a temporary database-side view or middleware filter that joins activity to issues and enforces issues.workspace_id = :workspace_id on every request.
- Reduce the blast radius by limiting workspace membership to trusted users until the upgrade completes.
# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai>=0.1.4"
# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
