CVE-2026-47419

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. PraisonAI Platform version 0.1.4 patches the issue.

Summary

Type: Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. File: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-112; route handlers at src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-100. Root cause: the route extracts workspace_id from the URL path and passes it to require_workspace_member for the membership check, but never threads it through to the service layer. AgentService.get calls session.get(Agent, agent_id), which is SELECT * FROM agents WHERE id = :agent_id with no AND workspace_id = :workspace_id. update and delete call self.get(agent_id) first and then mutate the returned row, inheriting the same gap. The MemberService is the one place in this codebase that does this correctly: it uses (workspace_id, user_id) as a composite key. The agent service simply forgot the second predicate, which is the textbook GHSA pattern for FastAPI services that treat routing parameters as decorative rather than authoritative.

Affected Code

File 1: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-55 and 105-112.

class AgentService:
    ...

    async def get(self, agent_id: str) -> Optional[Agent]:
        """Get agent by ID."""
        return await self._session.get(Agent, agent_id)            # <-- BUG: no workspace_id predicate

    async def update(
        self,
        agent_id: str,
        name: Optional[str] = None,
        ...
    ) -> Optional[Agent]:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return None
        ...
        return agent

    async def delete(self, agent_id: str) -> bool:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return False
        await self._session.delete(agent)
        await self._session.flush()
        return True

File 2: src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-101.

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(
    workspace_id: str,
    agent_id: str,
    user: AuthIdentity = Depends(require_workspace_member),         # only checks membership in workspace_id
    session: AsyncSession = Depends(get_db),
):
    svc = AgentService(session)
    agent = await svc.get(agent_id)                                 # <-- workspace_id never passed; svc.get returns any agent in the DB
    if agent is None:
        raise HTTPException(status_code=404, detail="Agent not found")
    return AgentResponse.model_validate(agent)

The update_agent (lines 67-87) and delete_agent (lines 90-100) handlers exhibit the same pattern: they receive workspace_id via path parameter, use it solely for the membership gate, then call svc.update(agent_id, ...) / svc.delete(agent_id) without re-checking which workspace the agent actually belongs to.

Why it's wrong: the workspace_id segment in the route is treated as a UI hint (it gates "are you in some workspace W?") rather than an authoritative predicate (it should also gate "is the resource you are addressing actually inside W?"). A standard fix in FastAPI/SQLAlchemy services is to make the resource-lookup query include the workspace predicate and treat absence as 404, so that a foreign-workspace agent is indistinguishable from a non-existent one. The codebase already does this…

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. PraisonAI Platform version 0.1.4 patches the issue.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. PraisonAI Platform version 0.1.4 patches the issue.

Summary

Type: Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. File: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-112; route handlers at src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-100. Root cause: the route extracts workspace_id from the URL path and passes it to require_workspace_member for the membership check, but never threads it through to the service layer. AgentService.get calls session.get(Agent, agent_id), which is SELECT * FROM agents WHERE id = :agent_id with no AND workspace_id = :workspace_id. update and delete call self.get(agent_id) first and then mutate the returned row, inheriting the same gap. The MemberService is the one place in this codebase that does this correctly: it uses (workspace_id, user_id) as a composite key. The agent service simply forgot the second predicate, which is the textbook GHSA pattern for FastAPI services that treat routing parameters as decorative rather than authoritative.

Affected Code

File 1: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-55 and 105-112.

class AgentService:
    ...

    async def get(self, agent_id: str) -> Optional[Agent]:
        """Get agent by ID."""
        return await self._session.get(Agent, agent_id)            # <-- BUG: no workspace_id predicate

    async def update(
        self,
        agent_id: str,
        name: Optional[str] = None,
        ...
    ) -> Optional[Agent]:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return None
        ...
        return agent

    async def delete(self, agent_id: str) -> bool:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return False
        await self._session.delete(agent)
        await self._session.flush()
        return True

File 2: src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-101.

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(
    workspace_id: str,
    agent_id: str,
    user: AuthIdentity = Depends(require_workspace_member),         # only checks membership in workspace_id
    session: AsyncSession = Depends(get_db),
):
    svc = AgentService(session)
    agent = await svc.get(agent_id)                                 # <-- workspace_id never passed; svc.get returns any agent in the DB
    if agent is None:
        raise HTTPException(status_code=404, detail="Agent not found")
    return AgentResponse.model_validate(agent)

The update_agent (lines 67-87) and delete_agent (lines 90-100) handlers exhibit the same pattern: they receive workspace_id via path parameter, use it solely for the membership gate, then call svc.update(agent_id, ...) / svc.delete(agent_id) without re-checking which workspace the agent actually belongs to.

Why it's wrong: the workspace_id segment in the route is treated as a UI hint (it gates "are you in some workspace W?") rather than an authoritative predicate (it should also gate "is the resource you are addressing actually inside W?"). A standard fix in FastAPI/SQLAlchemy services is to make the resource-lookup query include the workspace predicate and treat absence as 404, so that a foreign-workspace agent is indistinguishable from a non-existent one. The codebase already does this…

Summary

Type: Insecure Direct Object Reference. The agent CRUD endpoints (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) gate access on require_workspace_member(workspace_id) only, then resolve agent_id through AgentService.get(agent_id) which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace W1 can read, modify, or delete agents that belong to a different workspace W2 by guessing or harvesting an agent UUID and calling …/workspaces/W1/agents/<W2-agent-id>. File: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-112; route handlers at src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-100. Root cause: the route extracts workspace_id from the URL path and passes it to require_workspace_member for the membership check, but never threads it through to the service layer. AgentService.get calls session.get(Agent, agent_id), which is SELECT * FROM agents WHERE id = :agent_id with no AND workspace_id = :workspace_id. update and delete call self.get(agent_id) first and then mutate the returned row, inheriting the same gap. The MemberService is the one place in this codebase that does this correctly: it uses (workspace_id, user_id) as a composite key. The agent service simply forgot the second predicate, which is the textbook GHSA pattern for FastAPI services that treat routing parameters as decorative rather than authoritative.

Affected Code

File 1: src/praisonai-platform/praisonai_platform/services/agent_service.py, lines 53-55 and 105-112.

class AgentService:
    ...

    async def get(self, agent_id: str) -> Optional[Agent]:
        """Get agent by ID."""
        return await self._session.get(Agent, agent_id)            # <-- BUG: no workspace_id predicate

    async def update(
        self,
        agent_id: str,
        name: Optional[str] = None,
        ...
    ) -> Optional[Agent]:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return None
        ...
        return agent

    async def delete(self, agent_id: str) -> bool:
        agent = await self.get(agent_id)                           # <-- inherits the same gap
        if agent is None:
            return False
        await self._session.delete(agent)
        await self._session.flush()
        return True

File 2: src/praisonai-platform/praisonai_platform/api/routes/agents.py, lines 53-101.

@router.get("/{agent_id}", response_model=AgentResponse)
async def get_agent(
    workspace_id: str,
    agent_id: str,
    user: AuthIdentity = Depends(require_workspace_member),         # only checks membership in workspace_id
    session: AsyncSession = Depends(get_db),
):
    svc = AgentService(session)
    agent = await svc.get(agent_id)                                 # <-- workspace_id never passed; svc.get returns any agent in the DB
    if agent is None:
        raise HTTPException(status_code=404, detail="Agent not found")
    return AgentResponse.model_validate(agent)

The update_agent (lines 67-87) and delete_agent (lines 90-100) handlers exhibit the same pattern: they receive workspace_id via path parameter, use it solely for the membership gate, then call svc.update(agent_id, ...) / svc.delete(agent_id) without re-checking which workspace the agent actually belongs to.

Why it's wrong: the workspace_id segment in the route is treated as a UI hint (it gates "are you in some workspace W?") rather than an authoritative predicate (it should also gate "is the resource you are addressing actually inside W?"). A standard fix in FastAPI/SQLAlchemy services is to make the resource-lookup query include the workspace predicate and treat absence as 404, so that a foreign-workspace agent is indistinguishable from a non-existent one. The codebase already does this…