CVE-2026-47418: PraisonAI Platform Auth Bypass Vulnerability

CVE-2026-47418 Overview

CVE-2026-47418 is an Insecure Direct Object Reference (IDOR) vulnerability in PraisonAI Platform, the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 fail to enforce workspace boundaries on project CRUD endpoints. An authenticated user who belongs to any workspace can read, modify, delete, or retrieve statistics for projects owned by a different workspace. The flaw affects the GET, PATCH, and DELETE handlers under /workspaces/{workspace_id}/projects/{project_id} as well as the /stats endpoint. PraisonAI Platform version 0.1.4 remediates the issue by threading workspace_id through the service layer.

Critical Impact
Authenticated tenants can access and destroy projects across workspace boundaries, breaking multi-tenant isolation.

Affected Products

PraisonAI Platform versions prior to 0.1.4
MervinPraison/PraisonAI multi-agent teams system
Deployments exposing the platform layer to multiple workspace tenants

Discovery Timeline

2026-07-21 - CVE-2026-47418 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-47418

Vulnerability Analysis

The vulnerability stems from incomplete authorization checks on project CRUD endpoints. The route handlers invoke require_workspace_member(workspace_id) to confirm the caller belongs to the workspace identified in the URL. The handlers then resolve the target project through ProjectService.get(project_id), update(project_id, ...), delete(project_id), and get_stats(project_id). None of these service methods accept or validate the workspace_id parameter. The lookup uses the project identifier alone, so any authenticated caller with membership in workspace W1 can pass a project_id that belongs to workspace W2. The service returns or mutates the record without checking ownership.

The issue is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Root Cause

The root cause is a missing tenancy constraint in the service layer. The URL structure implies that workspace_id scopes the request, but the service functions treat project_id as a globally unique key. The authorization check verifies workspace membership for the URL-supplied workspace_id, not for the workspace that actually owns the project. This decoupling between the authorization predicate and the data lookup produces a horizontal privilege escalation.

Attack Vector

An attacker authenticates to any workspace on the target PraisonAI Platform instance. The attacker enumerates or guesses project_id values belonging to other workspaces. The attacker then issues requests such as GET /workspaces/{attacker_workspace}/projects/{victim_project_id} or DELETE /workspaces/{attacker_workspace}/projects/{victim_project_id}. The platform passes the workspace membership check and executes the operation against the victim project. Confidential project data, project modifications, and full project deletion are all reachable without elevated privileges.

The exploitation mechanism is described in the GitHub Security Advisory GHSA-943m-6wx2-rc2j and the fix is contained in Pull Request #1685.

Detection Methods for CVE-2026-47418

Indicators of Compromise

Requests where the workspace_id in the URL does not match the owning workspace of the returned project_id in application logs.
Unexpected PATCH or DELETE operations on projects from user accounts that never created them.
Bursts of sequential or randomized project_id values from a single authenticated session, indicating enumeration.
Access to /stats endpoints for projects across a large number of distinct workspaces from one user.

Detection Strategies

Instrument the application to log the resolved project owner alongside the URL workspace_id and alert on mismatches.
Correlate authentication identity with the workspace membership of every mutated or read project to catch cross-tenant access.
Build a baseline of normal per-user project access patterns and flag deviations that touch many workspaces.

Monitoring Recommendations

Forward PraisonAI Platform HTTP access and application logs to a central analytics pipeline for cross-tenant query analysis.
Monitor for anomalous volumes of GET /workspaces/*/projects/*/stats requests, which are low-cost enumeration primitives.
Track deletion and update rates per user account and alert when they exceed historical norms.

How to Mitigate CVE-2026-47418

Immediate Actions Required

Upgrade PraisonAI Platform to version 0.1.4 or later, which threads workspace_id through the service layer.
Audit application and database logs for cross-workspace project access, modification, or deletion prior to the upgrade.
Rotate any secrets, API tokens, or credentials stored inside projects that may have been accessed by non-owning users.
Notify affected workspace owners of potential unauthorized access or data loss.

Patch Information

The fix is delivered in PraisonAI Platform 0.1.4. The service methods ProjectService.get, update, delete, and get_stats now accept and enforce workspace_id, constraining the lookup to the workspace referenced in the URL. See the remediation commit and Pull Request #1685 for the exact code changes.

Workarounds

Restrict PraisonAI Platform access to a single trusted workspace tenant until the patch is applied.
Place a reverse proxy or API gateway rule in front of the platform that rejects requests where the caller is not a known member of the URL-referenced workspace and the project belongs to that same workspace, if that mapping can be resolved externally.
Temporarily disable public-facing project CRUD endpoints if multi-tenant isolation cannot be guaranteed.

bash

# Upgrade PraisonAI Platform to the patched release
pip install --upgrade "praisonai-platform>=0.1.4"

# Verify the installed version
python -c "import praisonai_platform; print(praisonai_platform.__version__)"