PraisonAI Platform, the foundation of the PraisonAI multi‑agent teams system, contains an Insecure Direct Object Reference in versions before 0.1.4. The CRUD endpoints for issues validate membership only on the workspace and then look up the issue by primary key without confirming the workspace. Therefore any member of one workspace can read, update or delete issues that belong to another workspace. This flaw, CWE‑639, allows unauthorized access, leading to potential data leakage, integrity violations, and service disruption if critical issues are altered or removed.

The vulnerability resides in PraisonAI Platform versions prior to 0.1.4 provided by MervinPraison. Version 0.1.4 and newer include the fix that enforces proper workspace scoping for issue CRUD operations.

The CVSS score of 8.3 indicates a high severity, and the EPSS score of less than 1% suggests very low current exploitation probability, though the flaw remains dangerous. Because the flaw is not listed in CISA’s KEV catalog, no widespread exploitation has been reported yet, but the attack vector is straightforward for any authorized user—simply call the CRUD endpoint with an issue_id belonging to another workspace. The risk remains high due to potential confidentiality, integrity, and availability impacts on cross‑workspace data.