CVE-2026-47409: PraisonAI Authorization Bypass Vulnerability

CVE-2026-47409 Overview

CVE-2026-47409 is an authorization bypass vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 allow any workspace member to remove any other member, including the workspace owner. The DELETE /workspaces/{workspace_id}/members/{user_id} endpoint is gated only by require_workspace_member(workspace_id) with a default min_role="member". The endpoint performs no caller-role check, no target-role check, and no guard preventing removal of the last owner. The flaw is categorized under [CWE-269] Improper Privilege Management.

Critical Impact
A single authenticated member can lock the owner out of a workspace with one DELETE request, breaking access control and workspace availability.

Affected Products

PraisonAI Platform versions prior to 0.1.4
PraisonAI multi-agent teams system deployments using the platform layer
PraisonAI Platform version 0.1.4 contains the fix

Discovery Timeline

2026-07-21 - CVE-2026-47409 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47409

Vulnerability Analysis

The vulnerability resides in the workspace member management endpoint of PraisonAI Platform. The DELETE /workspaces/{workspace_id}/members/{user_id} route enforces authorization solely through require_workspace_member(workspace_id), which defaults to min_role="member". Any authenticated user holding the lowest role in a workspace can invoke this endpoint against any other member. The handler does not compare the caller's role against the target's role and does not prevent removal of the final owner.

Exploitation requires only an authenticated member account and the target user identifier. A single HTTP DELETE call is sufficient to remove the workspace owner, revoking their administrative access and potentially locking out all privileged users. The impact is loss of integrity and availability of the workspace, while confidentiality remains unaffected because no data is disclosed by the operation itself.

Root Cause

The root cause is missing role-based access control in the member removal handler. The dependency require_workspace_member only verifies that the caller is a member. There is no check enforcing that the caller holds a role equal to or higher than the target, no restriction that only owners or admins can remove members, and no invariant that prevents deletion of the last remaining owner.

Attack Vector

The attack is remote and network-accessible. An attacker authenticates with any member-level account, discovers or enumerates the workspace ID and the owner's user ID, and issues a single DELETE request to the member management endpoint. No user interaction is required, and complexity is low.

python

# Security patch from PraisonAI Platform 0.1.4
# src/praisonai-platform/praisonai_platform/__main__.py

import argparse
import os
import sys


def main() -> None:
    default_host = os.environ.get("PLATFORM_HOST", "127.0.0.1")
    parser = argparse.ArgumentParser(description="PraisonAI Platform Server")
    parser.add_argument(
        "--host",
        default=default_host,
        help="Bind host (default: 127.0.0.1, or PLATFORM_HOST env)",
    )
    parser.add_argument("--port", type=int, default=8000, help="Bind port (default: 8000)")
    parser.add_argument("--reload", action="store_true", help="Enable auto-reload for development")
    args = parser.parse_args()

Source: GitHub Commit 24385d6. The batched security update also tightens the default bind host from 0.0.0.0 to 127.0.0.1 to reduce network exposure of the platform service.

Detection Methods for CVE-2026-47409

Indicators of Compromise

DELETE requests to /workspaces/{workspace_id}/members/{user_id} originating from non-owner, non-admin accounts.
Sudden absence of the workspace owner from the workspace membership list, or workspaces containing zero owners.
Application logs showing successful member removals where the caller and target user IDs differ and the caller lacks an elevated role.
Unexpected authentication failures or access-denied errors reported by the legitimate owner after a member-level session was active.

Detection Strategies

Enable HTTP access logging on the PraisonAI Platform and alert on any DELETE against the members endpoint outside a maintenance window.
Correlate DELETE events with the caller's role at the time of the request by joining API logs with the workspace membership table.
Run periodic integrity checks that verify every workspace retains at least one active owner.

Monitoring Recommendations

Ingest PraisonAI Platform application and reverse-proxy logs into a centralized logging or SIEM platform for retention and query.
Alert on repeated DELETE calls to /workspaces/*/members/* from the same account within a short time window, which may indicate enumeration.
Track EPSS scoring for CVE-2026-47409 and adjust monitoring priority as exploit likelihood changes.

How to Mitigate CVE-2026-47409

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later, which patches the missing authorization checks.
Audit workspace membership records to confirm every workspace still has a valid owner and restore any that were removed.
Rotate authentication tokens for any accounts observed calling the member removal endpoint suspiciously.
Restrict network access to the platform service, and bind to 127.0.0.1 or a trusted interface where feasible.

Patch Information

The fix is delivered in PraisonAI Platform version 0.1.4 via Pull Request #1686 and Commit 24385d6. Refer to the GitHub Security Advisory GHSA-w388-2392-px73 for complete remediation guidance.

Workarounds

If patching is not immediately possible, place the platform behind a reverse proxy that blocks DELETE requests to /workspaces/*/members/* from non-privileged principals.
Reduce the number of low-privileged workspace members and require elevated roles for daily operations until the upgrade is applied.
Bind the platform host to 127.0.0.1 using the PLATFORM_HOST environment variable to limit exposure to local operators.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai-platform>=0.1.4"

# Restrict the bind host as an additional hardening step
export PLATFORM_HOST=127.0.0.1
python -m praisonai_platform --host "$PLATFORM_HOST" --port 8000