CVE-2026-47406

Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists in the dependency management endpoints. The system verifies if a user is a member of a workspace but fails to verify if the specific issues or dependencies being accessed actually belong to that workspace. This allows an authenticated user to read, create, or delete dependencies for any issue across any workspace in a multi-tenant deployment.

Technical details include:

An attacker can link any two issues from different workspaces by providing a foreign depends on issue id in the request body, which can disrupt project planning and workflow rules in foreign workspaces.

Recommendations At the route layer, resolve and verify that both the issue id from the URL and the depends on issue id from the request body belong to the specified workspace id using the IssueService.get() function before allowing the operation to proceed.

Apply a similar verification to ensure that the issue id and the dep id belong to the workspace id when calling the list and delete dependency functions.

As a temporary mitigation, restrict access to the dependency management API endpoints to only highly trusted administrators.