CVE-2026-47399

{"id": "CVE-2026-47399", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47399", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T14:36:05.907729Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "praisonai-platform", "versions": [{"status": "affected", "version": "< 0.1.4"}]}]}], "published": "2026-07-21T17:17:08.950", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/pull/1686", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object's global UUID. The affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL. As a result, a valid member of `workspace_attacker` can call a route under `/api/v1/workspaces/{workspace_attacker}/...` while supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID. This breaks the platform's workspace isolation boundary. PraisonAI Platform version 0.1.4 patches the issue."}, {"lang": "es", "value": "La Plataforma PraisonAI es la capa de plataforma para el sistema de equipos multiagente de PraisonAI. Antes de la versi\u00f3n 0.1.4, las rutas REST con \u00e1mbito de espacio de trabajo contienen una falla sist\u00e9mica de autorizaci\u00f3n a nivel de objeto que permite a un usuario autenticado de un espacio de trabajo acceder, modificar y eliminar objetos pertenecientes a otro espacio de trabajo al proporcionar el UUID global del objeto v\u00edctima. El patr\u00f3n afectado aparece en rutas con \u00e1mbito de espacio de trabajo como agentes, proyectos, incidencias y comentarios. La capa de rutas verifica que el llamador es miembro del \u2019workspace_id\u2019 proporcionado en la URL, pero la capa de servicio luego resuelve el objeto objetivo solo por ID de objeto global. No verifica que el objeto resuelto realmente pertenece al espacio de trabajo en la URL. Como resultado, un miembro v\u00e1lido de \u2019workspace_attacker\u2019 puede llamar a una ruta bajo \u2019/api/v1/workspaces/{workspace_attacker}/...\u2019 mientras proporciona un UUID de objeto de \u2019workspace_victim\u2019. El servidor autoriza la solicitud bas\u00e1ndose en la membres\u00eda en \u2019workspace_attacker\u2019, luego obtiene o muta el objeto v\u00edctima por UUID global. Esto rompe el l\u00edmite de aislamiento de espacio de trabajo de la plataforma. La Plataforma PraisonAI versi\u00f3n 0.1.4 corrige el problema."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-advisories@github.com"}