CVE-2026-47417: PraisonAI Platform Auth Bypass Vulnerability

CVE-2026-47417 Overview

CVE-2026-47417 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to verify that an issue_id belongs to the requested workspace_id when handling comment endpoints. Any authenticated user who belongs to any workspace can read and post comments on issues in unrelated workspaces. The flaw is tracked under [CWE-639] Authorization Bypass Through User-Controlled Key. PraisonAI Platform version 0.1.4 patches the issue.

Critical Impact
A low-privileged user in any workspace can read and post comments on issues in every other workspace, breaking tenant isolation across the platform.

Affected Products

PraisonAI Platform versions prior to 0.1.4
Multi-tenant deployments exposing /workspaces/{workspace_id}/issues/{issue_id}/comments endpoints
Any PraisonAI multi-agent teams system relying on workspace-scoped comment isolation

Discovery Timeline

2026-07-21 - CVE-2026-47417 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-47417

Vulnerability Analysis

The vulnerability resides in the comment API surface of the PraisonAI Platform. Both POST /workspaces/{workspace_id}/issues/{issue_id}/comments and the corresponding GET endpoint enforce access control using only require_workspace_member(workspace_id). That guard confirms the caller is a member of the workspace identified in the URL path. It does not confirm that the referenced issue_id actually belongs to that workspace.

After the guard passes, the handlers invoke CommentService.create(issue_id=issue_id, ...) and CommentService.list_for_issue(issue_id) directly on the supplied issue identifier. Because the service layer trusts the identifier without a workspace-scoped lookup, an attacker who is a member of workspace W1 can substitute an issue_id that belongs to workspace W2 and successfully read or write comments there.

Root Cause

The root cause is a missing cross-object authorization check between the parent workspace_id and the child issue_id. Authorization is applied to the parent resource but not propagated to the child. This is the canonical IDOR pattern described by [CWE-639], where an attacker manipulates a user-controlled key to reach objects they should not access.

Attack Vector

An attacker requires a valid account in any single workspace. From that account, the attacker crafts an HTTP request to the comment endpoint using the target workspace ID they legitimately belong to, and substitutes an issue_id that belongs to another tenant. The server returns comments on, or accepts new comments to, the foreign issue. The attack is network-reachable, low-complexity, and requires no user interaction.

The realCodeExamples associated with the commit batch cover unrelated hardening in example files, so no exploit code is reproduced here. See the GitHub Security Advisory GHSA-cp4f-5m9r-5jc2 for full details.

Detection Methods for CVE-2026-47417

Indicators of Compromise

Requests to /workspaces/{workspace_id}/issues/{issue_id}/comments where the issue_id does not resolve to the same workspace_id in application logs.
Comment records whose parent issue belongs to a workspace that does not include the comment author as a member.
Bursts of GET requests iterating sequential or enumerated issue_id values from a single authenticated principal.

Detection Strategies

Add server-side audit logging that records the tuple (caller_user_id, workspace_id, issue_id, issue.workspace_id) on every comment API call and alert when the last two values diverge.
Query the datastore for comments where comment.author.workspace_membership does not intersect with issue.workspace_id to identify historical abuse.
Correlate authentication events with high-volume access to the comments endpoints from accounts that recently joined a workspace.

Monitoring Recommendations

Monitor PraisonAI Platform version strings across deployments and flag any instance below 0.1.4.
Track anomalous read volumes from single principals against the comments API and baseline expected per-user rates.
Forward application logs to a centralized analytics platform and alert on cross-workspace issue_id references.

How to Mitigate CVE-2026-47417

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later on all affected deployments.
Audit existing comments to identify entries authored by users who are not members of the parent issue's workspace, and remediate as needed.
Rotate API tokens or session credentials that may have been used by an attacker to exfiltrate comment content.

Patch Information

PraisonAI Platform version 0.1.4 fixes the missing authorization check by verifying that the supplied issue_id belongs to workspace_id before invoking CommentService. Review the fix in the GitHub Commit ef79b7a and the GitHub Security Advisory GHSA-cp4f-5m9r-5jc2.

Workarounds

If patching is not immediately possible, place the comment endpoints behind an application-layer proxy that validates issue_id ownership against workspace_id before forwarding requests.
Restrict workspace membership creation to trusted principals to reduce the population of accounts that can exploit the flaw.
Temporarily disable the comment endpoints in multi-tenant deployments where cross-tenant data exposure is unacceptable.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai-platform>=0.1.4"

# Verify installed version
pip show praisonai-platform | grep -i version