The PraisonAI Platform’s require_workspace_member dependency verifies that a caller is a member of the workspace ID specified in the URL, but the route handlers that follow load resources solely by primary key without checking that the resource’s own workspace_id matches the one in the URL. This omission allows an authenticated member of one workspace to supply another workspace’s ID in the URL prefix and the target resource’s ID in the path, thereby granting read, write, and delete access to resources belonging to an unrelated workspace. A second flaw resides in the member‑management endpoints: each inherits a default min_role of "member" from the dependency, permitting any authenticated member to promote themselves to admin or owner, demote or remove other members, or delete the workspace entirely. Registration is open without email verification, and the default server bind to 0.0.0.0:8000 exposes the API to the entire network, so an attacker can bootstrap an account with a simple curl from any external position. These weaknesses are reflected in CWE‑269, CWE‑639, and CWE‑863.

The vulnerability affects PraisonAI Platform, a multi‑agent teams system developed by MervinPraison. Versions prior to 0.1.4 are vulnerable; upgrade to 0.1.4 or later to obtain the fix.

With a CVSS score of 9.4, this is a critical vulnerability. The EPSS score of less than 1% indicates that, while the global exploit probability appears low, the lack of hardening on the API endpoints makes exploitation straightforward; an attacker only needs to issue crafted HTTP requests, perhaps starting with a simple curl. The vulnerability is not listed in the CISA KEV catalog, yet its combination of cross‑tenant data exposure and privilege escalation presents a high risk to any organization running PraisonAI Platform before the 0.1.4 update. An attacker can read, modify, or delete resources across workspaces and then elevate themselves to full administrative control within those workspaces, potentially compromising all data stored in the platform.