CVE-2026-47414: PraisonAI Platform IDOR Vulnerability

CVE-2026-47414 Overview

CVE-2026-47414 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 expose five label endpoints that authorize requests only through require_workspace_member(workspace_id). The endpoints pass URL-supplied label_id and issue_id values directly to LabelService without verifying that these resources belong to the target workspace. An authenticated workspace member can therefore read, modify, attach, or delete labels and issue-label associations in other workspaces. PraisonAI Platform version 0.1.4 patches the flaw.

Critical Impact
Any authenticated workspace member can manipulate labels and issue-label associations across arbitrary workspaces, leading to cross-tenant data tampering.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Label management endpoints under /workspaces/{workspace_id}/labels/
Issue-label association endpoints under /workspaces/{workspace_id}/issues/{issue_id}/labels/

Discovery Timeline

2026-07-21 - CVE-2026-47414 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47414

Vulnerability Analysis

The vulnerability affects five HTTP endpoints in PraisonAI Platform:

PATCH /workspaces/{workspace_id}/labels/{label_id}
DELETE /workspaces/{workspace_id}/labels/{label_id}
POST /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}
DELETE /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}
GET /workspaces/{workspace_id}/issues/{issue_id}/labels

Each endpoint enforces only workspace membership on workspace_id. The handler forwards label_id and issue_id values from the URL directly to LabelService. LabelService operates on the identifiers without confirming the referenced label or issue belongs to workspace_id. An attacker holding membership in any workspace can substitute identifiers from a foreign workspace and receive successful responses. This enables unauthorized reads and writes across tenants.

Root Cause

The root cause is missing object-level authorization. The application checks that the caller is a member of the workspace named in the URL, but never validates the ownership relationship between that workspace and the referenced label or issue. This is a textbook Insecure Direct Object Reference pattern under [CWE-639].

Attack Vector

Exploitation requires only a valid authenticated session in any workspace on the platform. The attacker sends a request such as PATCH /workspaces/A/labels/999, where workspace A is one the attacker legitimately belongs to and 999 is a label identifier belonging to workspace B. Because the identifier is a numeric primary key, values can be enumerated. The attacker can rename or delete labels, attach unauthorized labels to issues in other workspaces, or list label assignments belonging to foreign issues.

Code-level details of the fix are available in the upstream commit. See the GitHub Commit Overview and the GitHub Pull Request Discussion for the corrected authorization logic that scopes LabelService queries by workspace_id.

Detection Methods for CVE-2026-47414

Indicators of Compromise

Requests to label or issue-label endpoints where the label_id or issue_id in the URL does not correspond to a record owned by the workspace_id in the same URL.
Sequential enumeration of numeric label_id or issue_id values from a single authenticated session.
Unexpected label rename, deletion, or attachment events in audit logs originating from users who lack membership in the affected workspace.

Detection Strategies

Instrument LabelService to log the resolved workspace_id of each requested label and issue, and compare it to the URL-supplied workspace_id. Alert on mismatches.
Correlate application logs to identify users accessing label endpoints across workspace boundaries within short time windows.
Deploy web application firewall rules to flag high-volume access to /workspaces/*/labels/* and /workspaces/*/issues/*/labels/* endpoints from a single account.

Monitoring Recommendations

Monitor HTTP 4xx and 5xx rates on the five affected endpoints. Successful IDOR attempts often return 2xx instead of 403.
Track deletion and modification of labels per workspace and alert on activity from non-members.
Retain access logs for the PraisonAI Platform API for post-incident forensic review.

How to Mitigate CVE-2026-47414

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later, which enforces workspace ownership checks on both label_id and issue_id.
Audit label and issue-label records for unauthorized changes made prior to patching.
Rotate API tokens for any accounts observed making cross-workspace requests.

Patch Information

PraisonAI Platform version 0.1.4 fixes the vulnerability by validating that supplied label_id and issue_id values belong to the workspace_id in the request path before invoking LabelService. Review the fix in the GitHub Security Advisory GHSA-5jx9-w35f-vp65 and the associated GitHub Commit Overview.

Workarounds

If immediate upgrade is not possible, restrict access to the five affected endpoints at the reverse proxy or API gateway.
Add a middleware check that resolves label_id and issue_id to their owning workspace and rejects requests where the resolved workspace does not match the URL workspace_id.
Reduce the number of users with workspace membership to shrink the pool of authenticated attackers until the patched version is deployed.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai>=0.1.4"

# Verify installed version
python -c "import praisonai; print(praisonai.__version__)"