CVE-2026-47407

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

Summary

The Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id.

A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete.

There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced.

Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system.

Affected functionality

Every nested-resource route under /api/v1/workspaces/{workspace_id}/...:

| File | Routes | |------|--------| | routes/agents.py | GET /agents/{agent_id}, PATCH /agents/{agent_id}, DELETE /agents/{agent_id} | | routes/issues.py | GET /issues/{issue_id}, PATCH /issues/{issue_id}, DELETE /issues/{issue_id}, POST /issues/{issue_id}/comments, GET /issues/{issue_id}/comments | | routes/projects.py | GET /projects/{project_id}, PATCH /projects/{project_id}, DELETE /projects/{project_id}, GET /projects/{project_id}/stats | | routes/labels.py | PATCH /labels/{label_id}, DELETE /labels/{label_id}, POST /issues/{issue_id}/labels/{label_id}, DELETE /issues/{issue_id}/labels/{label_id}, GET /issues/{issue_id}/labels | | routes/dependencies.py | every route | | routes/workspaces.py | PATCH /{workspace_id}, DELETE /{workspace_id}, POST /{workspace_id}/members, PATCH /{workspace_id}/members/{user_id}, DELETE /{workspace_id}/members/{user_id} (these have a role-enforcement bug rather than a cross-tenant bug) |

Root cause

A. The auth dependency only sees the URL prefix

src/praisonai-platform/praisonai_platform/api/deps.py:54-73:

async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    member_svc = MemberService(session)
    has = await member_svc.has_role(workspace_id, user.id, min_role)
    if not has:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=...)
    user.workspace_id = workspace_id
    return user

This only validates that the user is a member of the URL workspace_id. It does not (and cannot, given its signature) validate any inner resource ID.

B. The service-layer lookups are unscoped

Example, src/praisonai-platform/praisonai_platform/services/agent_service.py:53-55:

async def get(self, agent_id: str) -> Optional[Agent]:
    return await self._session.get(Agent, agent_id)

And the route, src/praisonai-platform/praisonai_platform/api/routes/agents.py:53-64:

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(workspace_id: str, agent_id: str,
                    user: AuthIdentity = Depends(require_workspace_member),
                    session: AsyncSession = Depends(get_db)):
    svc = AgentService(session)
    agent = await svc.get(agent_id)             # ← no…

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

Summary

The Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id.

A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete.

There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced.

Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system.

Affected functionality

Every nested-resource route under /api/v1/workspaces/{workspace_id}/...:

| File | Routes | |------|--------| | routes/agents.py | GET /agents/{agent_id}, PATCH /agents/{agent_id}, DELETE /agents/{agent_id} | | routes/issues.py | GET /issues/{issue_id}, PATCH /issues/{issue_id}, DELETE /issues/{issue_id}, POST /issues/{issue_id}/comments, GET /issues/{issue_id}/comments | | routes/projects.py | GET /projects/{project_id}, PATCH /projects/{project_id}, DELETE /projects/{project_id}, GET /projects/{project_id}/stats | | routes/labels.py | PATCH /labels/{label_id}, DELETE /labels/{label_id}, POST /issues/{issue_id}/labels/{label_id}, DELETE /issues/{issue_id}/labels/{label_id}, GET /issues/{issue_id}/labels | | routes/dependencies.py | every route | | routes/workspaces.py | PATCH /{workspace_id}, DELETE /{workspace_id}, POST /{workspace_id}/members, PATCH /{workspace_id}/members/{user_id}, DELETE /{workspace_id}/members/{user_id} (these have a role-enforcement bug rather than a cross-tenant bug) |

Root cause

A. The auth dependency only sees the URL prefix

src/praisonai-platform/praisonai_platform/api/deps.py:54-73:

async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    member_svc = MemberService(session)
    has = await member_svc.has_role(workspace_id, user.id, min_role)
    if not has:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=...)
    user.workspace_id = workspace_id
    return user

This only validates that the user is a member of the URL workspace_id. It does not (and cannot, given its signature) validate any inner resource ID.

B. The service-layer lookups are unscoped

Example, src/praisonai-platform/praisonai_platform/services/agent_service.py:53-55:

async def get(self, agent_id: str) -> Optional[Agent]:
    return await self._session.get(Agent, agent_id)

And the route, src/praisonai-platform/praisonai_platform/api/routes/agents.py:53-64:

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(workspace_id: str, agent_id: str,
                    user: AuthIdentity = Depends(require_workspace_member),
                    session: AsyncSession = Depends(get_db)):
    svc = AgentService(session)
    agent = await svc.get(agent_id)             # ← no…

Summary

The Platform server exposes resources under /api/v1/workspaces/{workspace_id}/... and protects them with a require_workspace_member(workspace_id) FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (agent_id, issue_id, project_id, label_id, comment_id, dependency_id) by primary key alone. The resource's own workspace_id is never compared to the URL's workspace_id.

A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete.

There is a second bug in the member-management routes (add_member, update_member_role, remove_member, update_workspace, delete_workspace). Each one inherits the default min_role="member" from require_workspace_member. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced.

Registration is open at /api/v1/auth/register with no email verification. The default server bind is 0.0.0.0:8000 (python -m praisonai_platform). One curl from any unauthenticated network position is enough to bootstrap into the system.

Affected functionality

Every nested-resource route under /api/v1/workspaces/{workspace_id}/...:

| File | Routes | |------|--------| | routes/agents.py | GET /agents/{agent_id}, PATCH /agents/{agent_id}, DELETE /agents/{agent_id} | | routes/issues.py | GET /issues/{issue_id}, PATCH /issues/{issue_id}, DELETE /issues/{issue_id}, POST /issues/{issue_id}/comments, GET /issues/{issue_id}/comments | | routes/projects.py | GET /projects/{project_id}, PATCH /projects/{project_id}, DELETE /projects/{project_id}, GET /projects/{project_id}/stats | | routes/labels.py | PATCH /labels/{label_id}, DELETE /labels/{label_id}, POST /issues/{issue_id}/labels/{label_id}, DELETE /issues/{issue_id}/labels/{label_id}, GET /issues/{issue_id}/labels | | routes/dependencies.py | every route | | routes/workspaces.py | PATCH /{workspace_id}, DELETE /{workspace_id}, POST /{workspace_id}/members, PATCH /{workspace_id}/members/{user_id}, DELETE /{workspace_id}/members/{user_id} (these have a role-enforcement bug rather than a cross-tenant bug) |

Root cause

A. The auth dependency only sees the URL prefix

src/praisonai-platform/praisonai_platform/api/deps.py:54-73:

 async def require_workspace_member(
    workspace_id: str,
    user: AuthIdentity = Depends(get_current_user),
    session: AsyncSession = Depends(get_db),
    min_role: str = "member",
) -> AuthIdentity:
    member_svc = MemberService(session)
    has = await member_svc.has_role(workspace_id, user.id, min_role)
    if not has:
        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail=...)
    user.workspace_id = workspace_id
    return user

This only validates that the user is a member of the URL workspace_id. It does not (and cannot, given its signature) validate any inner resource ID.

B. The service-layer lookups are unscoped

Example, src/praisonai-platform/praisonai_platform/services/agent_service.py:53-55:

async def get(self, agent_id: str) -> Optional[Agent]:
   return await self._session.get(Agent, agent_id)

And the route, src/praisonai-platform/praisonai_platform/api/routes/agents.py:53-64:

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(workspace_id: str, agent_id: str,
                    user: AuthIdentity = Depends(require_workspace_member),
                    session: AsyncSession = Depends(get_db)):
    svc = AgentService(session)
    agent = await svc.get(agent_id)             # ← no…