PT-2026-45068

CVE-2026-48169

Published

2026-05-29

Updated

2026-10-23

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PraisonAI Platform (affected versions not specified)

Description The PraisonAI Platform API contains authorization failures that break workspace isolation. The service layer for issues and projects performs global primary-key lookups without verifying workspace ownership, allowing any authenticated user to read, modify, or delete resources in any workspace by manipulating UUIDs in API requests. Additionally, member management endpoints only require a member role, enabling any workspace member to promote themselves to owner and remove the original owner.

Technical details include:

API Endpoints: /api/v1/workspaces/{workspace id}/issues/{issue id} and /api/v1/workspaces/{workspace id}/projects/{project id} are susceptible to Insecure Direct Object Reference (IDOR) because the service layer ignores the workspace id provided in the URL.
Vulnerable Parameters: The issue id and project id variables are used for global lookups without workspace scoping.
Function Names: IssueService.get(), IssueService.update(), IssueService.delete(), ProjectService.get(), ProjectService.update(), ProjectService.delete(), and ProjectService.get stats() fail to enforce workspace boundaries. Furthermore, update member role() and remove member() in the workspace routes lack proper role hierarchy checks.

Recommendations

Scope all get(), update(), and delete() methods in IssueService and ProjectService to verify that the resource belongs to the provided workspace id.
Modify the API routes to pass the workspace id from the URL to the corresponding service methods.
Update member management routes to require the owner role via the require workspace member() dependency.
Implement guards in update member role() to prevent self-promotion and role escalation.
Implement guards in remove member() to prevent the removal of the last workspace owner and to enforce role hierarchy.