PraisonAI Platform’s workspace‑scoped REST routes, before version 0.1.4, authorize requests solely on the caller’s membership in the workspace specified in the URL. The service layer, however, resolves objects by their globally unique UUID without cross‑checking that the object actually belongs to that workspace, creating a CWE‑284 (Improper Authorization) and CWE‑639 (Authorization Bypass) weakness. Thus an authenticated user in one workspace can supply a victim’s global UUID and obtain read, modify, or delete rights on objects from another workspace, breaking the platform’s isolation boundary.

This flaw affects MervinPraison’s PraisonAI Platform. Any deployment using repository versions before 0.1.4 is susceptible. The affected functionality includes agent, project, issue, and comment APIs that are scoped by workspace ID but reference objects by a global identifier.

Despite a CVSS score of 8.8, the EPSS score is below 1% and the vulnerability is not in the CISA KEV catalog, suggesting limited exploitation in the wild at present. However, the flaw offers a straightforward privilege escalation path for any authenticated user; it requires only knowledge of a victim’s global object ID, which may be discoverable through enumeration or other legitimate channels. The attack vector is local to authenticated sessions, but once within the platform, the attacker can freely read, modify, or delete cross‑workspace data, undermining confidentiality, integrity, and availability of the affected workspaces.