CVE-2026-47405

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from member to owner; add arbitrary users as owner or admin; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from member to owner; add arbitrary users as owner or admin; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

Summary

PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner.

The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members.

As a result, a normal workspace member can:

• promote their own account from member to owner;
• add arbitrary users as owner or admin;
• change other members' roles;
• remove legitimate owners or members;
• take over workspace membership completely;
• perform destructive workspace operations after escalation.

This is a broken access control / vertical privilege escalation vulnerability.

Details

The vulnerable authorization dependency is defined in:

praisonai_platform/api/deps.py

The dependency defaults to the lowest workspace role:

async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    ...
    has = await member_svc.has_role(workspace_id, user.id, min_role)

Because min_role defaults to "member", any route using:

Depends(require_workspace_member)

without explicitly passing a stronger role only requires ordinary workspace membership.

Privileged workspace-management routes in:

praisonai_platform/api/routes/workspaces.py

use this dependency unchanged on administrative actions, including:

PATCH  /workspaces/{workspace_id}
DELETE /workspaces/{workspace_id}
POST   /workspaces/{workspace_id}/members
PATCH  /workspaces/{workspace_id}/members/{user_id}
DELETE /workspaces/{workspace_id}/members/{user_id}

These routes allow workspace modification, deletion, member addition, role changes, and member removal. They should require admin or owner, but they currently require only member.

The membership service does not provide a second authorization layer. In:

praisonai_platform/services/member_service.py

the mutation methods perform the requested change after the route-level check passes:

async def add(...):
    member = Member(workspace_id=workspace_id, user_id=user_id, role=role)

async def update_role(...):
    member = await self.get(workspace_id, user_id)
    member.role = new_role

async def remove(...):
    member = await self.get(workspace_id, user_id)
    await self._session.delete(member)

Therefore, the weak route dependency is the effective authorization boundary.

A low-privilege user can also learn their own user.id from the normal authentication response. The login/register response includes the authenticated user object:

TokenResponse.token
TokenResponse.user.id

This allows an invited low-privilege member to target their own membership record and self-promote.

Affected component

Package: praisonai-platform
Verified version: 0.1.2
Verified source commit: d8a8a78
Affected components:
- praisonai_platform/api/deps.py
- praisonai_platform/api/routes/workspaces.py
- praisonai_platform/services/member_service.py
- praisonai_platform/api/routes/auth.py
- praisonai_platform/api/schemas.py

PoC

The following PoC is self-contained and exercises the real PraisonAI Platform FastAPI application path. It does not mock the vulnerable RBAC logic.

The PoC:

1. Creates the real FastAPI app with praisonai_platform.api.app.create_app().
2. Registers three users through the real /api/v1/auth/register route.
3. Creates a workspace as the original owner.
4. Adds the second user as a normal member.
5. Logs in as that low-privilege member.
6. Uses the low-privilege member token to self-promote to owner.
7. Uses the same token to add a third account as owner.…

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from member to owner; add arbitrary users as owner or admin; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner. The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members. As a result, a normal workspace member can promote their own account from member to owner; add arbitrary users as owner or admin; change other members' roles; remove legitimate owners or members; take over workspace membership completely; and/or perform destructive workspace operations after escalation. This is a broken access control / vertical privilege escalation vulnerability. PraisonAI Platform version 0.1.4 patches the issue.

Summary

PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner.

The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members.

As a result, a normal workspace member can:

• promote their own account from member to owner;
• add arbitrary users as owner or admin;
• change other members' roles;
• remove legitimate owners or members;
• take over workspace membership completely;
• perform destructive workspace operations after escalation.

This is a broken access control / vertical privilege escalation vulnerability.

Details

The vulnerable authorization dependency is defined in:

praisonai_platform/api/deps.py

The dependency defaults to the lowest workspace role:

async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    ...
    has = await member_svc.has_role(workspace_id, user.id, min_role)

Because min_role defaults to "member", any route using:

Depends(require_workspace_member)

without explicitly passing a stronger role only requires ordinary workspace membership.

Privileged workspace-management routes in:

praisonai_platform/api/routes/workspaces.py

use this dependency unchanged on administrative actions, including:

PATCH  /workspaces/{workspace_id}
DELETE /workspaces/{workspace_id}
POST   /workspaces/{workspace_id}/members
PATCH  /workspaces/{workspace_id}/members/{user_id}
DELETE /workspaces/{workspace_id}/members/{user_id}

These routes allow workspace modification, deletion, member addition, role changes, and member removal. They should require admin or owner, but they currently require only member.

The membership service does not provide a second authorization layer. In:

praisonai_platform/services/member_service.py

the mutation methods perform the requested change after the route-level check passes:

async def add(...):
    member = Member(workspace_id=workspace_id, user_id=user_id, role=role)

async def update_role(...):
    member = await self.get(workspace_id, user_id)
    member.role = new_role

async def remove(...):
    member = await self.get(workspace_id, user_id)
    await self._session.delete(member)

Therefore, the weak route dependency is the effective authorization boundary.

A low-privilege user can also learn their own user.id from the normal authentication response. The login/register response includes the authenticated user object:

TokenResponse.token
TokenResponse.user.id

This allows an invited low-privilege member to target their own membership record and self-promote.

Affected component

Package: praisonai-platform
Verified version: 0.1.2
Verified source commit: d8a8a78
Affected components:
- praisonai_platform/api/deps.py
- praisonai_platform/api/routes/workspaces.py
- praisonai_platform/services/member_service.py
- praisonai_platform/api/routes/auth.py
- praisonai_platform/api/schemas.py

PoC

The following PoC is self-contained and exercises the real PraisonAI Platform FastAPI application path. It does not mock the vulnerable RBAC logic.

The PoC:

1. Creates the real FastAPI app with praisonai_platform.api.app.create_app().
2. Registers three users through the real /api/v1/auth/register route.
3. Creates a workspace as the original owner.
4. Adds the second user as a normal member.
5. Logs in as that low-privilege member.
6. Uses the low-privilege member token to self-promote to owner.
7. Uses the same token to add a third account as owner.…

Summary

PraisonAI Platform has a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own role to owner.

The issue is caused by privileged workspace-management routes using the shared dependency require_workspace_member(...) without requiring admin or owner. The dependency defaults to min_role="member", so routes that should be administrative are accessible to ordinary workspace members.

As a result, a normal workspace member can:

• promote their own account from member to owner;
• add arbitrary users as owner or admin;
• change other members' roles;
• remove legitimate owners or members;
• take over workspace membership completely;
• perform destructive workspace operations after escalation.

This is a broken access control / vertical privilege escalation vulnerability.

Details

The vulnerable authorization dependency is defined in:

praisonai_platform/api/deps.py

The dependency defaults to the lowest workspace role:

async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    ...
    has = await member_svc.has_role(workspace_id, user.id, min_role)

Because min_role defaults to "member", any route using:

Depends(require_workspace_member)

without explicitly passing a stronger role only requires ordinary workspace membership.

Privileged workspace-management routes in:

praisonai_platform/api/routes/workspaces.py

use this dependency unchanged on administrative actions, including:

PATCH  /workspaces/{workspace_id}
DELETE /workspaces/{workspace_id}
POST   /workspaces/{workspace_id}/members
PATCH  /workspaces/{workspace_id}/members/{user_id}
DELETE /workspaces/{workspace_id}/members/{user_id}

These routes allow workspace modification, deletion, member addition, role changes, and member removal. They should require admin or owner, but they currently require only member.

The membership service does not provide a second authorization layer. In:

praisonai_platform/services/member_service.py

the mutation methods perform the requested change after the route-level check passes:

async def add(...):
    member = Member(workspace_id=workspace_id, user_id=user_id, role=role)

async def update_role(...):
    member = await self.get(workspace_id, user_id)
    member.role = new_role

async def remove(...):
    member = await self.get(workspace_id, user_id)
    await self._session.delete(member)

Therefore, the weak route dependency is the effective authorization boundary.

A low-privilege user can also learn their own user.id from the normal authentication response. The login/register response includes the authenticated user object:

TokenResponse.token
TokenResponse.user.id

This allows an invited low-privilege member to target their own membership record and self-promote.

Affected component

Package: praisonai-platform
Verified version: 0.1.2
Verified source commit: d8a8a78
Affected components:
- praisonai_platform/api/deps.py
- praisonai_platform/api/routes/workspaces.py
- praisonai_platform/services/member_service.py
- praisonai_platform/api/routes/auth.py
- praisonai_platform/api/schemas.py

PoC

The following PoC is self-contained and exercises the real PraisonAI Platform FastAPI application path. It does not mock the vulnerable RBAC logic.

The PoC:

1. Creates the real FastAPI app with praisonai_platform.api.app.create_app().
2. Registers three users through the real /api/v1/auth/register route.
3. Creates a workspace as the original owner.
4. Adds the second user as a normal member.
5. Logs in as that low-privilege member.
6. Uses the low-privilege member token to self-promote to owner.
7. Uses the same token to add a third account as owner.…