CVE-2026-47411: PraisonAI Platform Auth Bypass Flaw

CVE-2026-47411 Overview

CVE-2026-47411 is an authorization bypass vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 allow any authenticated workspace member to modify workspace metadata and settings. The PATCH /workspaces/{workspace_id} endpoint enforces only require_workspace_member(workspace_id) with a default min_role="member", granting low-privileged users write access to fields normally restricted to administrators. Because the settings field is a free-form JSON blob consumed by downstream code, the flaw becomes a configuration-injection primitive. PraisonAI Platform 0.1.4 patches the issue [CWE-269].

Critical Impact
Any authenticated workspace member can tamper with workspace name, description, and arbitrary settings JSON, enabling configuration injection against downstream platform components.

Affected Products

PraisonAI Platform versions prior to 0.1.4
PraisonAI multi-agent teams system deployments using the platform layer
Any downstream service consuming workspace settings JSON

Discovery Timeline

2026-07-21 - CVE-2026-47411 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47411

Vulnerability Analysis

The vulnerability is an improper privilege management flaw [CWE-269] in the PraisonAI Platform workspace API. The PATCH /workspaces/{workspace_id} handler gates access using require_workspace_member(workspace_id) with the default role check set to member. This permits any user assigned to the workspace, regardless of administrative status, to rewrite workspace metadata.

The attack requires network access, low privileges, and no user interaction. Confidentiality is not directly impacted, but integrity is high because attackers can overwrite trusted configuration state.

Root Cause

The root cause is missing role-based authorization on a state-changing endpoint. Write operations to workspace configuration should require an administrator or owner role, but the endpoint accepts the lowest tier of workspace membership. Sensitive fields including name, description, and the free-form settings JSON object are exposed to modification without an elevated role check.

Attack Vector

An authenticated attacker with member role on a target workspace sends a PATCH request to /workspaces/{workspace_id} with a modified JSON body. The request updates settings with attacker-controlled keys and values. Because settings is unstructured JSON, the impact depends on how downstream components deserialize and act on those values. Consumers that treat settings as trusted configuration can be steered into insecure states, feature toggles can be flipped, and integrations that read secrets or endpoints from settings can be redirected.

No verified public proof-of-concept code is available. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-47411

Indicators of Compromise

Unexpected PATCH /workspaces/{workspace_id} requests originating from non-administrative accounts.
Audit log entries showing changes to workspace name, description, or settings performed by users with member role.
Downstream services logging unexpected configuration values or feature flag transitions sourced from workspace settings.

Detection Strategies

Enable structured logging on the workspace API and alert when PATCH operations occur outside expected administrative accounts.
Diff workspace settings JSON snapshots over time to identify unauthorized modifications.
Correlate workspace mutation events with the acting principal's role to identify privilege mismatches.

Monitoring Recommendations

Monitor for high-frequency PATCH requests against the /workspaces/ route from a single session.
Track downstream services that read the settings blob and alert on value changes that trigger sensitive behaviors.
Baseline normal workspace configuration change velocity and alert on deviations.

How to Mitigate CVE-2026-47411

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later, which patches the authorization check.
Audit workspace settings JSON across all workspaces for unexpected keys or values introduced by non-administrative members.
Review workspace membership rosters and revoke member access for accounts that do not require it.

Patch Information

PraisonAI Platform version 0.1.4 corrects the authorization logic on the PATCH /workspaces/{workspace_id} endpoint. Consult the GitHub Security Advisory GHSA-rcmc-q9rj-4wmq for release details and upgrade guidance.

Workarounds

Restrict network access to the workspace API to trusted administrative sessions until the upgrade is applied.
Deploy a reverse proxy or API gateway rule that blocks PATCH requests to /workspaces/{workspace_id} from non-administrator identities.
Treat any values read from workspace settings as untrusted input and validate them against an allowlist in downstream code.

bash

# Example gateway rule blocking PATCH on workspace endpoint for non-admin roles
# Replace <admin-group> with your identity provider's admin claim
location ~ ^/workspaces/[^/]+$ {
    if ($request_method = PATCH) {
        set $deny 1;
    }
    if ($jwt_claim_role = "admin") {
        set $deny 0;
    }
    if ($deny = 1) { return 403; }
    proxy_pass http://praisonai_backend;
}