PT-2026-45058 · Unknown · Praisonai-Platform

CVE-2026-47399

·

Published

2026-05-29

·

Updated

2026-07-21

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions PraisonAI Platform (affected versions not specified)
Description A systemic object-level authorization flaw exists in workspace-scoped REST routes. An authenticated user can access, modify, or delete objects belonging to another workspace by providing the target object's global UUID. While the route layer verifies the user is a member of the workspace id provided in the URL, the service layer resolves the object using only the global ID without verifying if that object actually belongs to the specified workspace. This breaks tenant isolation and affects routes for agents, projects, issues, and comments.
API Endpoints:
  • /api/v1/workspaces/{workspace id}/agents/{agent id}
  • /api/v1/workspaces/{workspace id}/projects/{project id}
  • /api/v1/workspaces/{workspace id}/issues/{issue id}
  • /api/v1/workspaces/{workspace id}/comments/{comment id}
Vulnerable Parameters or Variables:
  • workspace id
  • agent id
  • project id
  • issue id
Recommendations
  • Require every object fetch, update, and delete method to take both workspace id and the object ID.
  • Enforce object ownership in the service layer by verifying that the resolved object's workspace ID matches the provided workspace id.
  • Avoid using service methods that resolve workspace-owned objects by global UUID alone.
  • Apply object-level ownership checks to agents, projects, issues, comments, and dependencies.
  • For helpers pivoting from issue id, validate that the parent issue belongs to the authorized workspace before returning or modifying child records.
  • Return 404 Not Found or 403 Forbidden when an object does not belong to the authorized workspace.

Exploit

Fix

IDOR

Improper Access Control

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639CWE-284

Related Identifiers

CVE-2026-47399
GHSA-6H6V-6M7W-7VXX
PYSEC-2026-2930

Affected Products

Praisonai-Platform