CVE-2026-47412: PraisonAI Platform Auth Bypass Vulnerability

CVE-2026-47412 Overview

CVE-2026-47412 is an authorization bypass vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 expose the DELETE /workspaces/{workspace_id} endpoint behind only a require_workspace_member(workspace_id) gate with min_role="member". Any workspace member can issue a single DELETE request to destroy the entire workspace. The cascade removes every project, issue, comment, agent, label, and member record via foreign-key relationships. No owner-role check, confirmation token, soft-delete window, or recovery path exists. The vulnerability is classified under CWE-269: Improper Privilege Management.

Critical Impact
A single authenticated request from any workspace member permanently destroys all workspace data with no recovery mechanism.

Affected Products

PraisonAI Platform versions prior to 0.1.4
PraisonAI multi-agent teams system (platform layer component)
Deployments exposing the workspace management API

Discovery Timeline

2026-07-21 - CVE-2026-47412 published to NVD
2026-07-22 - Last updated in NVD database
Patch - PraisonAI Platform version 0.1.4 released with fix (see GitHub Commit 24385d64)

Technical Details for CVE-2026-47412

Vulnerability Analysis

The flaw is a broken access control defect in the workspace deletion route. The endpoint enforces membership but not ownership. Any user assigned the default member role passes the authorization gate and can invoke the destructive operation. This violates the principle of least privilege for destructive administrative actions.

The deletion cascades through foreign-key relationships. Projects, issues, comments, agents, labels, and member records are all removed atomically. Because the platform implements no soft-delete window, no confirmation token, and no audit-based recovery, the impact is permanent.

Root Cause

The root cause is an incorrect dependency injection on the DELETE route. The route relies on require_workspace_member(workspace_id) with min_role="member", treating destructive delete as equivalent to read-level access. A dedicated require_workspace_owner check or explicit role guard was missing prior to version 0.1.4.

Attack Vector

An authenticated attacker with any workspace membership sends a single HTTP DELETE request to /workspaces/{workspace_id}. No user interaction from other members is required. The request executes, cascade-deletes all associated records, and returns success. The attacker requires only low privileges over the network.

python

# Patch excerpt: src/praisonai-platform/praisonai_platform/api/routes/agents.py
# Source: https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47

from praisonaiagents.auth import AuthIdentity

-from ..deps import ensure_resource_in_workspace, get_db, require_workspace_member
+from ..deps import get_db, require_workspace_member
 from ..schemas import AgentCreate, AgentResponse, AgentUpdate
 from ...services.agent_service import AgentService

python

# Patch excerpt: src/praisonai-platform/praisonai_platform/__main__.py
# Source: https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47

import argparse
+import os
import sys


def main() -> None:
+    default_host = os.environ.get("PLATFORM_HOST", "127.0.0.1")
    parser = argparse.ArgumentParser(description="PraisonAI Platform Server")
-   parser.add_argument("--host", default="0.0.0.0", help="Bind host (default: 0.0.0.0)")
+   parser.add_argument(
+       "--host",
+       default=default_host,
+       help="Bind host (default: 127.0.0.1, or PLATFORM_HOST env)",
+   )
    parser.add_argument("--port", type=int, default=8000, help="Bind port (default: 8000)")

The companion patch also changes the default bind host from 0.0.0.0 to 127.0.0.1, reducing accidental network exposure of the platform API.

Detection Methods for CVE-2026-47412

Indicators of Compromise

HTTP DELETE /workspaces/{workspace_id} requests originating from accounts that do not hold the workspace owner role.
Sudden loss of all projects, issues, comments, agents, and labels tied to a single workspace ID.
Successful 2xx response codes returned to DELETE requests against workspace endpoints from non-privileged sessions.

Detection Strategies

Parse PraisonAI Platform API access logs for DELETE method calls against /workspaces/* paths and correlate the requester role with the target workspace ownership.
Alert on any workspace deletion event and cross-reference the initiating identity against the workspace owner list.
Baseline normal deletion frequency per tenant and trigger anomaly alerts on unexpected mass cascade removals.

Monitoring Recommendations

Forward PraisonAI Platform reverse-proxy and application logs to a centralized SIEM or data lake for retention and correlation.
Enable database audit logging for cascade DELETE operations on workspace and dependent tables.
Monitor authentication events for suspicious member additions immediately preceding workspace deletion attempts.

How to Mitigate CVE-2026-47412

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later without delay.
Audit existing workspace membership and remove untrusted or dormant member accounts.
Take offline backups of workspace data before upgrading or applying configuration changes.
Restrict network exposure of the platform API to trusted networks and known clients.

Patch Information

PraisonAI Platform version 0.1.4 patches the issue. Fix details are available in GitHub Pull Request #1686 and the GitHub Security Advisory GHSA-g8rr-7rj2-f627. The commit 24385d64 contains the code changes.

Workarounds

Place PraisonAI Platform behind a reverse proxy or API gateway that blocks DELETE /workspaces/{workspace_id} requests until the upgrade is applied.
Bind the platform to 127.0.0.1 and require authenticated tunneling for administrative access.
Reduce workspace membership to a minimal trusted set until version 0.1.4 is deployed.

bash

# Reverse proxy rule (NGINX) to block workspace deletion until patched
location ~ ^/workspaces/[^/]+$ {
    if ($request_method = DELETE) {
        return 403;
    }
    proxy_pass http://127.0.0.1:8000;
}

# Restrict PraisonAI Platform bind host after upgrade to 0.1.4
export PLATFORM_HOST=127.0.0.1
praisonai-platform --host 127.0.0.1 --port 8000