High severity8.3GHSA Advisory· Published Jul 21, 2026· Updated Jul 21, 2026
CVE-2026-47415
CVE-2026-47415
Description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/issues/{issue_id}) gate access on require_workspace_member(workspace_id) only, then resolve issue_id through IssueService.get(issue_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete issues that belong to a different workspace W2. PraisonAI Platform version 0.1.4 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
praisonai-platformPyPI | < 0.1.4 | 0.1.4 |
Affected products
1Patches
Vulnerability mechanics
References
3News mentions
1- Praisonai Platform: Four High-Severity IDOR and Destructive Action Flaws DisclosedVypr Intelligence · Jun 1, 2026