CVE-2026-47408
CVE-2026-47408 · praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
This page contains facts from public vulnerability sources. Check the original advisory before updating.
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity` endpoint is gated by `require_workspace_member(workspace_id)` and dispatches to `ActivityService.list_for_issue(issue_id)`, which executes `SELECT * FROM activity WHERE issue_id = :issue_id` with no workspace constraint. A user who is a member of any workspace can read the full activity log of any issue across the entire multi-tenant deployment. PraisonAI Platform version 0.1.4 patches the issue.
CVSS 6.5 · Medium · EPSS 0.3% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
praisonai-platform
- Versions
- < 0.1.4: Affected
No fix published
praisonai-platform PyPI
- Versions
- 0.1.0
- 0.1.1
- 0.1.2
- 0.1.3
- Affected ranges
- ECOSYSTEM: < 0.1.4
Update to 0.1.4