CVE-2026-47415: PraisonAI Platform Auth Bypass Vulnerability

CVE-2026-47415 Overview

CVE-2026-47415 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to enforce workspace scope on issue lookups. The issue CRUD endpoints validate only that the caller is a member of the workspace named in the URL, then resolve issue_id through a primary-key lookup with no workspace constraint. An authenticated member of any workspace can read, modify, or delete issues that belong to a different workspace. PraisonAI Platform version 0.1.4 patches the flaw.

Critical Impact
Any authenticated workspace member can access, modify, or delete issues in unrelated workspaces, breaking tenant isolation across the platform.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Issue CRUD endpoints: GET, PATCH, DELETE /workspaces/{workspace_id}/issues/{issue_id}
Multi-tenant deployments relying on workspace-level access control

Discovery Timeline

2026-07-21 - CVE-2026-47415 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47415

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference classified as [CWE-639]. PraisonAI Platform exposes issue management endpoints scoped by workspace in the URL, following the pattern /workspaces/{workspace_id}/issues/{issue_id}. Access control on these endpoints invokes require_workspace_member(workspace_id), which confirms the caller belongs to the workspace identified in the URL path.

After the membership check, the handler resolves the issue by calling IssueService.get(issue_id). This service performs a primary-key lookup against the issues table without joining or filtering on workspace_id. The retrieved issue is then returned, updated, or deleted regardless of which workspace owns it.

An attacker who is a legitimate member of workspace W1 can invoke the endpoint with their own workspace ID in the URL, satisfying the membership check, while supplying an issue_id that belongs to workspace W2. The platform serves the cross-tenant record.

Root Cause

The root cause is a missing authorization check between the resource identifier and its parent scope. The membership guard trusts the workspace_id URL parameter, while IssueService.get never verifies that the returned issue's workspace_id matches the requested scope. The two identifiers are treated independently instead of being validated together.

Attack Vector

Exploitation requires only low-privileged authenticated access and no user interaction. An attacker with a valid session in any workspace enumerates or guesses issue_id values and calls the CRUD endpoints. GET returns the issue body, PATCH mutates it, and DELETE removes it. Consult the GitHub Security Advisory GHSA-xwq8-frcg-77q8 and the remediation commit for technical details.

Detection Methods for CVE-2026-47415

Indicators of Compromise

Requests to /workspaces/{workspace_id}/issues/{issue_id} where the resolved issue belongs to a different workspace than the URL path indicates.
Sequential or enumerated issue_id values in access logs originating from a single account.
PATCH or DELETE operations on issues by users who never created or commented on them.
Unexpected 200 responses to issue endpoints from accounts with limited workspace membership.

Detection Strategies

Correlate application logs with the database to flag any request where the URL workspace_id differs from the stored workspace_id of the returned issue.
Alert on high-rate iteration of issue_id values by a single principal, which suggests IDOR enumeration.
Review audit trails for issue mutations performed by users outside the owning workspace's membership list.

Monitoring Recommendations

Enable verbose access logging on all /workspaces/*/issues/* routes and retain request/response metadata.
Instrument IssueService.get to emit a warning when the resolved issue's workspace does not match the request context.
Track anomalies in per-user issue access patterns, including sudden volume spikes and access outside typical working sets.

How to Mitigate CVE-2026-47415

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later, which enforces workspace scoping on issue lookups.
Audit issue access logs since deployment for cross-workspace reads, updates, or deletions and notify affected tenants.
Rotate any credentials or tokens exposed through issue bodies that may have been read by unauthorized users.
Restrict network access to the platform to trusted identities while patching is in progress.

Patch Information

PraisonAI Platform 0.1.4 fixes the vulnerability by scoping issue resolution to the workspace in the URL. Full details are available in the GitHub Security Advisory GHSA-xwq8-frcg-77q8 and the upstream commit.

Workarounds

If immediate upgrade is not possible, add a middleware or service-layer check that compares the URL workspace_id with the retrieved issue's workspace_id and returns 404 on mismatch.
Temporarily disable the affected GET, PATCH, and DELETE issue endpoints in multi-tenant deployments until the patch is applied.
Limit workspace membership to trusted users to reduce the population of accounts able to exploit the flaw.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai>=0.1.4"

# Verify installed version
pip show praisonai | grep -i version