CVE-2026-47408

Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)

Description An Insecure Direct Object Reference exists in the multi-tenant deployment. The endpoint '/workspaces/{workspace id}/issues/{issue id}/activity' uses the workspace id only to verify membership but fails to verify if the requested issue id actually belongs to that workspace. This allows a member of any workspace to access the full activity logs of any issue across the entire platform if they possess the issue UUID. The activity logs contain sensitive operational data, including actor identities, action types, and a details JSON blob containing pre- and post-change values, which could be used for reconnaissance or to uncover embedded secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/workspaces/{workspace id}/issues/{issue id}/activity' endpoint to minimize the risk of unauthorized data disclosure.