CVE-2026-47409

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can remove any other member, including the workspace owner, using a single DELETE. There is no caller-role check, no target-role check, no "cannot remove last owner" guard. PraisonAI Platform version 0.1.4 patches the issue.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47
https://github.com/MervinPraison/PraisonAI/pull/1686
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w388-2392-px73
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w388-2392-px73

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) PraisonAI Platform es la capa de plataforma para el sistema de equipos multiagente de PraisonAI. Las versiones anteriores a la 0.1.4 tienen una omisión de autorización que permite el bloqueo del propietario. El endpoint “DELETE /workspaces/{workspace_id}/members/{user_id}” está protegido solo por “require_workspace_member(workspace_id)” (por defecto “min_role=“member””). Cualquier miembro puede eliminar a cualquier otro miembro, incluyendo al propietario del espacio de trabajo, usando una única solicitud DELETE. No hay verificación de rol del invocador, ni verificación de rol del objetivo, ni protección ’no se puede eliminar al último propietario’. La versión 0.1.4 de PraisonAI Platform corrige el problema.

Information

Published : 2026-07-21 17:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-47409

Mitre link : CVE-2026-47409

CVE.ORG link : CVE-2026-47409

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

CWE-862

Missing Authorization

{"id": "CVE-2026-47409", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47409", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T18:27:48.906663Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "MervinPraison", "product": "praisonai-platform", "versions": [{"status": "affected", "version": "< 0.1.4"}]}]}], "published": "2026-07-21T17:17:09.640", "references": [{"url": "https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/pull/1686", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w388-2392-px73", "source": "security-advisories@github.com"}, {"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-w388-2392-px73", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can remove any other member, including the workspace owner, using a single DELETE. There is no caller-role check, no target-role check, no \"cannot remove last owner\" guard. PraisonAI Platform version 0.1.4 patches the issue."}, {"lang": "es", "value": "PraisonAI Platform es la capa de plataforma para el sistema de equipos multiagente de PraisonAI. Las versiones anteriores a la 0.1.4 tienen una omisi\u00f3n de autorizaci\u00f3n que permite el bloqueo del propietario. El endpoint \u201cDELETE /workspaces/{workspace_id}/members/{user_id}\u201d est\u00e1 protegido solo por \u201crequire_workspace_member(workspace_id)\u201d (por defecto \u201cmin_role=\u201cmember\u201d\u201d). Cualquier miembro puede eliminar a cualquier otro miembro, incluyendo al propietario del espacio de trabajo, usando una \u00fanica solicitud DELETE. No hay verificaci\u00f3n de rol del invocador, ni verificaci\u00f3n de rol del objetivo, ni protecci\u00f3n \u2019no se puede eliminar al \u00faltimo propietario\u2019. La versi\u00f3n 0.1.4 de PraisonAI Platform corrige el problema."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-advisories@github.com"}