PraisonAI Platform, the core layer of the PraisonAI multi‑agent teams system, contains an IDOR flaw in versions before 0.1.4. Five label‑related API endpoints – PATCH /workspaces/{workspace_id}/labels/{label_id}, DELETE /workspaces/{workspace_id}/labels/{label_id}, POST /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}, DELETE /workspaces/{workspace_id}/issues/{issue_id}/labels/{label_id}, and GET /workspaces/{workspace_id}/issues/{issue_id}/labels – only verify that the caller is a member of the target workspace. They then forward the supplied label_id and issue_id straight to the LabelService without confirming that those identifiers belong to that workspace. This omission permits any workspace‑member to modify, delete, or link labels that belong to another workspace, effectively enabling cross‑workspace manipulation of labeling data and associated issue relationships.

The affected product is MervinPraison’s PraisonAI Platform. Versions prior to 0.1.4 are impacted and must be updated to 0.1.4 or later to eliminate the vulnerability.

The CVSS score of 7.6 indicates a high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be any user with workspace membership who can issue the vulnerable API calls, as the flaw does not require elevated privileges beyond standard workspace access. An attacker can therefore manipulate labels across workspaces, affecting data integrity and potentially causing confusion or unauthorized classification.