CVE-2026-58653: PraisonAI Auth Bypass Vulnerability

CVE-2026-58653 Overview

CVE-2026-58653 is an authorization bypass vulnerability in PraisonAI versions prior to 0.1.7. The application fails to validate that the project_id supplied in issue create and update request bodies belongs to the workspace referenced in the URL. Authenticated attackers can create or modify issues that reference projects owned by other workspaces. This behavior corrupts project statistics aggregation across tenants, since queries do not enforce workspace constraints. The flaw is categorized under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated tenants can inject issues into projects belonging to other workspaces, resulting in cross-tenant data pollution of aggregated project metrics.

Affected Products

PraisonAI versions prior to 0.1.7
Multi-tenant deployments exposing issue create and update endpoints
Workspaces relying on project statistics aggregation

Discovery Timeline

2026-07-02 - CVE-2026-58653 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58653

Vulnerability Analysis

PraisonAI exposes issue endpoints scoped to a workspace through the URL path. Request handlers accept a project_id value inside the JSON body when creating or updating issues. The server trusts this client-supplied identifier without cross-referencing it against the workspace segment of the URL. An authenticated user with low privileges in one workspace can supply the project_id of a project belonging to a different tenant. The backend persists the issue against the foreign project, and subsequent aggregation queries include the injected record in that project's statistics. Because the workspace scope is never enforced at the data layer, tenant boundaries collapse for reporting and metrics.

Root Cause

The root cause is a missing consistency check between the workspace identifier in the request URL and the project_id supplied in the request body. The application performs authorization at the URL level but treats body parameters as trusted inputs. This is a textbook Insecure Direct Object Reference pattern documented in CWE-639.

Attack Vector

Exploitation requires only an authenticated account with issue-creation permissions in any workspace. The attacker enumerates or guesses valid project_id values from other tenants. They then submit a POST or PATCH request to their own workspace's issue endpoint while supplying the foreign project_id in the body. The server accepts the request and links the issue to the victim project. See the VulnCheck Authorization Bypass Advisory and the GitHub Security Advisory for further technical detail.

Detection Methods for CVE-2026-58653

Indicators of Compromise

Issue records whose project_id resolves to a project outside the requester's workspace
Sudden growth in project issue counts without corresponding activity from workspace members
API access logs showing POST or PATCH requests to issue endpoints containing project_id values from foreign tenants

Detection Strategies

Run reconciliation queries that compare the workspace of each issue's parent project against the workspace derived from the creating user's session context.
Alert on any issue whose project_id cannot be joined to a project within the same workspace scope.
Monitor project statistics dashboards for anomalous spikes contributed by users who are not members of the owning workspace.

Monitoring Recommendations

Enable verbose request logging for all issue create and update endpoints, capturing both URL path parameters and body fields.
Ingest PraisonAI application logs into a centralized analytics platform and correlate user_id, workspace_id, and project_id fields.
Build periodic audits of issue-to-project-to-workspace mappings to detect cross-tenant references introduced before patching.

How to Mitigate CVE-2026-58653

Immediate Actions Required

Upgrade PraisonAI to version 0.1.7 or later, which enforces workspace validation on project_id.
Audit existing issues for any records whose project_id references a project outside the creating workspace, and quarantine them for review.
Rotate API tokens issued to low-privilege tenant accounts that could have exercised the bypass.

Patch Information

The maintainers addressed the flaw in PraisonAI 0.1.7. The fix adds server-side validation ensuring that any project_id provided in issue create or update payloads belongs to the workspace identified in the URL. Details are available in the GitHub Security Advisory GHSA-2fjj-qqg8-fg7x.

Workarounds

Place an API gateway or reverse proxy in front of PraisonAI to reject requests where the body project_id does not resolve to the URL workspace.
Restrict issue create and update permissions to trusted accounts until the upgrade is deployed.
Disable cross-workspace project statistics dashboards to limit downstream impact of any polluted records.

bash

# Upgrade PraisonAI to the patched release
pip install --upgrade 'praisonai>=0.1.7'

# Verify the installed version
python -c "import praisonai; print(praisonai.__version__)"