CVE-2026-48169: PraisonAI Auth Bypass Vulnerability

CVE-2026-48169 Overview

CVE-2026-48169 is an authorization vulnerability in the PraisonAI Platform API, a multi-agent teams system. Versions prior to 0.1.4 contain two authorization failures that break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership. Any authenticated user can read, modify, and delete resources in any workspace by swapping UUIDs in API requests. Additionally, every member management endpoint only requires min_role="member", allowing any workspace member to promote themselves to owner and remove the original owner. The flaw is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key).

Critical Impact
A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to.

Affected Products

PraisonAI Platform API versions prior to 0.1.4
Multi-agent teams system deployments using the affected service layer
Workspaces sharing the vulnerable route and service layers

Discovery Timeline

2026-08-07 - CVE-2026-48169 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-48169

Vulnerability Analysis

The PraisonAI Platform API exposes issue and project resources through routes scoped by workspace_id. The route layer correctly extracts workspace_id from the URL and verifies membership using the require_workspace_member() dependency. However, the service layer ignores this workspace scope and performs primary-key lookups against the global resource tables. This design gap allows an authenticated user in any workspace to read, modify, or delete resources belonging to other workspaces by substituting the target resource UUID in requests.

A second flaw compounds the impact. Member management endpoints (add member, update role, remove member) enforce only min_role="member" rather than owner-level privilege. Any member can promote themselves to owner or evict the legitimate owner, resulting in full workspace takeover.

Root Cause

The root cause is an authorization boundary mismatch between the route and service layers. The require_workspace_member() dependency correctly validates membership at the route level. The service layer does not consume that context and does not enforce workspace-scoped queries or role-level checks for privileged member operations.

Attack Vector

Exploitation requires an authenticated account with membership in at least one workspace. The attacker enumerates or guesses UUIDs of resources in other workspaces and issues normal API requests, substituting target IDs. For workspace takeover, the attacker calls the member management endpoints against their own workspace to elevate their role or remove the owner. No user interaction is required from victims.

// Example exploitation code (sanitized)
No verified public exploit code is available. Refer to the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-48169

Indicators of Compromise

API requests where the authenticated user's workspace membership does not include the workspace_id associated with the resource being accessed.
Unexpected role changes on the member management endpoints, especially self-promotion to owner.
Removal of the original workspace owner followed by role changes for other members.
Bursts of resource lookups against issue or project UUIDs not previously accessed by the account.

Detection Strategies

Correlate authenticated user identity with the workspace_id of every accessed issue or project and alert on mismatches.
Audit member management endpoint calls and flag any role transition to owner performed by a non-owner caller.
Compare route-layer authorization context against service-layer resource ownership in application logs.

Monitoring Recommendations

Enable verbose logging on PraisonAI Platform API endpoints handling issues, projects, and member management.
Track UUID access patterns per account to detect enumeration or cross-workspace access.
Alert on ownership transitions and membership removals in workspace audit logs.

How to Mitigate CVE-2026-48169

Immediate Actions Required

Upgrade the PraisonAI Platform API to version 0.1.4 or later, which patches both authorization failures.
Review workspace audit logs for unauthorized role changes and cross-workspace resource access since deployment.
Rotate API tokens and reset ownership on any workspace showing suspicious member management activity.

Patch Information

Version 0.1.4 of the PraisonAI Platform API patches both authorization defects. The fix enforces workspace-scoped lookups in the service layer for issues and projects, and requires owner-level privilege for member management endpoints. See the GitHub Security Advisory GHSA-gv23-xrm3-8c62 and the PyPA Advisory Database Entry for full details.

Workarounds

If immediate upgrade is not possible, restrict API access to trusted users only and monitor all workspace member changes.
Add an application-layer proxy or middleware that validates workspace_id from the URL against resource ownership before forwarding requests.
Temporarily disable public member management endpoints until the patched version is deployed.

bash

# Configuration example
pip install --upgrade praisonai-platform==0.1.4