CVE-2026-47409

Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)

Description An authorization bypass exists that allows a user with a member role to remove any other member from a workspace, including the workspace owner. This occurs because the DELETE /workspaces/{workspace id}/members/{user id} endpoint only requires the caller to be a member of the workspace, without verifying if the caller has the necessary administrative privileges or if the target user is the last owner. The root cause is located in the MemberService.remove() function, which deletes the member record without performing caller-role checks or implementing owner-protection logic. An attacker can exploit this by obtaining the user id of the owner and sending a DELETE request to the affected endpoint, effectively locking the legitimate owner out of their own workspace.

Recommendations Restrict access to the DELETE /workspaces/{workspace id}/members/{user id} endpoint to users with the owner role. Implement a check within the remove member logic to prevent the removal of the last remaining owner of a workspace. Avoid using the user id parameter in the DELETE /workspaces/{workspace id}/members/{user id} endpoint if the caller does not possess owner or admin privileges.