PT-2026-45065 · Unknown · Praisonai-Platform

CVE-2026-47414

·

Published

2026-05-29

·

Updated

2026-07-21

CVSS v3.1

7.6

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Name of the Vulnerable Software and Affected Versions praisonai-platform (affected versions not specified)
Description An Insecure Direct Object Reference (IDOR) exists in the label management functionality. The application fails to verify if the requested label or issue belongs to the workspace associated with the authenticated user, relying only on a membership check for the workspace ID provided in the URL. This allows an authenticated user to manipulate labels and issue associations across different workspaces in a multi-tenant deployment.
API Endpoints:
  • 'PATCH /workspaces/{workspace id}/labels/{label id}'
  • 'DELETE /workspaces/{workspace id}/labels/{label id}'
  • 'POST /workspaces/{workspace id}/issues/{issue id}/labels/{label id}'
  • 'DELETE /workspaces/{workspace id}/issues/{issue id}/labels/{label id}'
  • 'GET /workspaces/{workspace id}/issues/{issue id}/labels'
Vulnerable Parameters or Variables:
  • workspace id
  • label id
  • issue id
Function Names:
  • get()
  • update()
  • delete()
  • add to issue()
  • remove from issue()
  • list for issue()
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the affected API endpoints to minimize the risk of cross-workspace data manipulation.

Exploit

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-47414
GHSA-5JX9-W35F-VP65
PYSEC-2026-2929

Affected Products

Praisonai-Platform