CVE-2026-47405

CVE-2026-47405 · PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to `owner`. The issue is caused by privileged workspace-management routes using the shared dependency `require_workspace_member(...)` without requiring `admin` or `owner`. The dependency defaults to `min_role="member"`, so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from `member` to `owner`; add arbitrary users as `owner` or `admin`; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

CVSS 8.8 · Hoch · EPSS 0,4% · Korrektur verfügbar

Veröffentlicht

2026-07-21T16:18:27.991Z

Aktualisiert

2026-07-21T17:59:03.862Z

Technologie-Stack: python

Prüfen Sie Ihren Server →