CVE-2026-48169

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.

Summary

The PraisonAI Platform API has two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to.

Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides.

Details

Part 1: Cross-Workspace IDOR (Issues and Projects)

Vulnerable Files:

• praisonai_platform/services/issue_service.py
• praisonai_platform/services/project_service.py
• praisonai_platform/api/routes/issues.py
• praisonai_platform/api/routes/projects.py

There is a consistent split between the route layer and the service layer. Routes pull workspace_id from the URL and verify membership:

GET /api/v1/workspaces/{workspace_id}/issues/{issue_id}
                        ^^^^^^^^^^^^^^
                        require_workspace_member() checks this

But the service methods these routes call perform global lookups that ignore workspace_id entirely:

IssueService.get(), line 72:

async def get(self, issue_id: str) -> Optional[Issue]:
    """Get issue by ID."""
    return await self._session.get(Issue, issue_id)

ProjectService.get(), line 47:

async def get(self, project_id: str) -> Optional[Project]:
    """Get project by ID."""
    return await self._session.get(Project, project_id)

Both use session.get(Model, pk), which is a global lookup by primary key with no WHERE workspace_id = ? filter.

Compare that with the properly scoped list_for_workspace() methods in the same files:

IssueService.list_for_workspace(), line 76:

async def list_for_workspace(self, workspace_id: str, ...) -> list[Issue]:
    stmt = select(Issue).where(Issue.workspace_id == workspace_id)
    # ... properly scoped

The listing is scoped correctly. The get, update, and delete methods are not. Since update() and delete() in both services call self.get() internally, the workspace bypass cascades through all write operations too.

Route that discards workspace_id, issues.py line 82:

@router.get("/{issue_id}", response_model=IssueResponse)
async def get_issue(
    workspace_id: str,                                        # Extracted from URL
    issue_id: str,
    user: AuthIdentity = Depends(require_workspace_member),   # Membership verified
    session: AsyncSession = Depends(get_db),
):
    svc = IssueService(session)
    issue = await svc.get(issue_id)   # workspace_id never passed to service

All affected operations:

| Service | Method | Line | Workspace scoped? | |---------|--------|------|-------------------| | IssueService | get() | 72 | No, uses session.get(Issue, issue_id) | | IssueService | update() | 97 | No, calls self.get(issue_id) | | IssueService | delete() | 150 | No, calls self.get(issue_id) | | IssueService | list_for_workspace() | 76 | Yes, filters by workspace_id | | ProjectService | get() | 47 | No, uses session.get(Project, project_id) | | ProjectService | update() | 62 | No, calls self.get(project_id) | | ProjectService | delete() | 88 | No, calls self.get(project_id) | | ProjectService | get_stats() | 97 | No, only…

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.

Summary

The PraisonAI Platform API has two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to.

Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides.

Details

Part 1: Cross-Workspace IDOR (Issues and Projects)

Vulnerable Files:

• praisonai_platform/services/issue_service.py
• praisonai_platform/services/project_service.py
• praisonai_platform/api/routes/issues.py
• praisonai_platform/api/routes/projects.py

There is a consistent split between the route layer and the service layer. Routes pull workspace_id from the URL and verify membership:

GET /api/v1/workspaces/{workspace_id}/issues/{issue_id}
                        ^^^^^^^^^^^^^^
                        require_workspace_member() checks this

But the service methods these routes call perform global lookups that ignore workspace_id entirely:

IssueService.get(), line 72:

async def get(self, issue_id: str) -> Optional[Issue]:
    """Get issue by ID."""
    return await self._session.get(Issue, issue_id)

ProjectService.get(), line 47:

async def get(self, project_id: str) -> Optional[Project]:
    """Get project by ID."""
    return await self._session.get(Project, project_id)

Both use session.get(Model, pk), which is a global lookup by primary key with no WHERE workspace_id = ? filter.

Compare that with the properly scoped list_for_workspace() methods in the same files:

IssueService.list_for_workspace(), line 76:

async def list_for_workspace(self, workspace_id: str, ...) -> list[Issue]:
    stmt = select(Issue).where(Issue.workspace_id == workspace_id)
    # ... properly scoped

The listing is scoped correctly. The get, update, and delete methods are not. Since update() and delete() in both services call self.get() internally, the workspace bypass cascades through all write operations too.

Route that discards workspace_id, issues.py line 82:

@router.get("/{issue_id}", response_model=IssueResponse)
async def get_issue(
    workspace_id: str,                                        # Extracted from URL
    issue_id: str,
    user: AuthIdentity = Depends(require_workspace_member),   # Membership verified
    session: AsyncSession = Depends(get_db),
):
    svc = IssueService(session)
    issue = await svc.get(issue_id)   # workspace_id never passed to service

All affected operations:

| Service | Method | Line | Workspace scoped? | |---------|--------|------|-------------------| | IssueService | get() | 72 | No, uses session.get(Issue, issue_id) | | IssueService | update() | 97 | No, calls self.get(issue_id) | | IssueService | delete() | 150 | No, calls self.get(issue_id) | | IssueService | list_for_workspace() | 76 | Yes, filters by workspace_id | | ProjectService | get() | 47 | No, uses session.get(Project, project_id) | | ProjectService | update() | 62 | No, calls self.get(project_id) | | ProjectService | delete() | 88 | No, calls self.get(project_id) | | ProjectService | get_stats() | 97 | No, only…

Summary

The PraisonAI Platform API has two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires min_role="member", which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to.

Both issues come from the same gap: the route layer pulls workspace_id from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The require_workspace_member() dependency does its job correctly. The problem is that the service layer doesn't use the information it provides.

Details

Part 1: Cross-Workspace IDOR (Issues and Projects)

Vulnerable Files:

• praisonai_platform/services/issue_service.py
• praisonai_platform/services/project_service.py
• praisonai_platform/api/routes/issues.py
• praisonai_platform/api/routes/projects.py

There is a consistent split between the route layer and the service layer. Routes pull workspace_id from the URL and verify membership:

GET /api/v1/workspaces/{workspace_id}/issues/{issue_id}
                        ^^^^^^^^^^^^^^
                        require_workspace_member() checks this

But the service methods these routes call perform global lookups that ignore workspace_id entirely:

IssueService.get(), line 72:

async def get(self, issue_id: str) -> Optional[Issue]:
    """Get issue by ID."""
    return await self._session.get(Issue, issue_id)

ProjectService.get(), line 47:

async def get(self, project_id: str) -> Optional[Project]:
    """Get project by ID."""
    return await self._session.get(Project, project_id)

Both use session.get(Model, pk), which is a global lookup by primary key with no WHERE workspace_id = ? filter.

Compare that with the properly scoped list_for_workspace() methods in the same files:

IssueService.list_for_workspace(), line 76:

async def list_for_workspace(self, workspace_id: str, ...) -> list[Issue]:
    stmt = select(Issue).where(Issue.workspace_id == workspace_id)
    # ... properly scoped

The listing is scoped correctly. The get, update, and delete methods are not. Since update() and delete() in both services call self.get() internally, the workspace bypass cascades through all write operations too.

Route that discards workspace_id, issues.py line 82:

@router.get("/{issue_id}", response_model=IssueResponse)
async def get_issue(
    workspace_id: str,                                        # Extracted from URL
    issue_id: str,
    user: AuthIdentity = Depends(require_workspace_member),   # Membership verified
    session: AsyncSession = Depends(get_db),
):
    svc = IssueService(session)
    issue = await svc.get(issue_id)   # workspace_id never passed to service

All affected operations:

| Service | Method | Line | Workspace scoped? | |---------|--------|------|-------------------| | IssueService | get() | 72 | No, uses session.get(Issue, issue_id) | | IssueService | update() | 97 | No, calls self.get(issue_id) | | IssueService | delete() | 150 | No, calls self.get(issue_id) | | IssueService | list_for_workspace() | 76 | Yes, filters by workspace_id | | ProjectService | get() | 47 | No, uses session.get(Project, project_id) | | ProjectService | update() | 62 | No, calls self.get(project_id) | | ProjectService | delete() | 88 | No, calls self.get(project_id) | | ProjectService | get_stats() | 97 | No, only…