CVE-2026-47413 Overview
CVE-2026-47413 is a privilege escalation vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 expose the POST /workspaces/{workspace_id}/members endpoint without enforcing caller permissions on the target role. The endpoint is gated only by require_workspace_member(workspace_id) with a default min_role="member", then forwards the request body directly to MemberService.add(workspace_id, user_id, role). Any workspace member can promote themselves, an attacker-controlled account, or a targeted victim to workspace owner. PraisonAI Platform version 0.1.4 patches the flaw. The issue is tracked as [CWE-269: Improper Privilege Management].
Critical Impact
A low-privileged workspace member can grant workspace ownership to any user, achieving full cross-tenant control over workspace data and configuration.
Affected Products
- PraisonAI Platform versions prior to 0.1.4
- Multi-tenant workspaces exposing the /workspaces/{workspace_id}/members API
- Deployments where workspace membership is granted to untrusted or lower-trust users
Discovery Timeline
- 2026-07-21 - CVE-2026-47413 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-47413
Vulnerability Analysis
The vulnerability resides in PraisonAI Platform's workspace membership management API. The POST /workspaces/{workspace_id}/members route accepts a JSON body containing user_id and role, and forwards both fields unchecked to MemberService.add(). The only authorization gate is require_workspace_member(workspace_id) with a default minimum role of member, which confirms the caller belongs to the workspace but never validates that the caller has the authority to add other users or to assign the requested role.
Because MemberService.add() performs no caller-permission check of its own, the endpoint effectively delegates authorization to a middleware that only verifies presence, not privilege. This is a textbook Improper Privilege Management flaw [CWE-269], compounded by broken access control on a state-changing multi-tenant endpoint.
Root Cause
The root cause is a missing role-comparison check between the caller's effective role and the role being assigned. Correct multi-tenant designs require that only owner or admin roles can invite members, and that no caller may assign a role higher than their own. Neither invariant is enforced in versions prior to 0.1.4.
Attack Vector
An authenticated user with the lowest workspace privilege sends a crafted POST request to /workspaces/{workspace_id}/members with role: "owner" and any user_id, including a newly created attacker-controlled account or a victim account the attacker wants to grief. The scope changes because the newly injected owner gains full control over workspace resources originally belonging to a different tenant administrator.
The patch introduces caller-permission checks inside the member-service path so that role assignment is validated against the caller's own role. Refer to the GitHub Security Advisory GHSA-8g2p-pqm3-fcfh and the GitHub Commit Details for the exact code changes.
Detection Methods for CVE-2026-47413
Indicators of Compromise
- Unexpected POST /workspaces/{workspace_id}/members requests originating from accounts with member role
- Workspace audit records showing new owner or admin role grants where the granting user is not already an owner or admin
- Newly created user accounts added as owner shortly after registration
- Sudden role changes for high-value accounts without corresponding administrator activity
Detection Strategies
- Inspect application logs for MemberService.add invocations where the caller's role is lower than the assigned role
- Alert on any successful HTTP 200/201 response to /workspaces/*/members where the request body contains "role": "owner"
- Correlate account-creation events with immediate workspace ownership grants to identify attacker-controlled second accounts
Monitoring Recommendations
- Enable verbose audit logging for all workspace membership and role-change operations
- Forward PraisonAI Platform application logs to a centralized log store for retention and search
- Baseline the normal rate of owner and admin role assignments per workspace and alert on deviations
How to Mitigate CVE-2026-47413
Immediate Actions Required
- Upgrade PraisonAI Platform to version 0.1.4 or later without delay
- Audit the workspace_members table for unexpected owner or admin grants issued before the upgrade
- Revoke unauthorized memberships and rotate credentials for any account that was elevated by an untrusted caller
- Restrict workspace invitations to trusted users until the patch is deployed
Patch Information
PraisonAI Platform version 0.1.4 introduces caller-permission enforcement in the member-add code path, ensuring that only users with sufficient privilege can invite new members or assign elevated roles. The fix is available in the upstream repository referenced by the GitHub Security Advisory and the corresponding commit ef79b7a.
Workarounds
- Place the /workspaces/{workspace_id}/members endpoint behind an API gateway rule that rejects requests where the caller's role is below admin
- Temporarily disable self-service workspace membership until the upgrade is complete
- Reduce the population of member-role users in sensitive workspaces to limit the exploit surface
# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai>=0.1.4"
# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
