Description
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints (`POST /workspaces/{workspace_id}/issues/{issue_id}/comments` and `GET .../comments`) gate access on `require_workspace_member(workspace_id)` only, then call `CommentService.create(issue_id=issue_id, ...)` and `CommentService.list_for_issue(issue_id)` without verifying that `issue_id` belongs to `workspace_id`. A user who is a member of any workspace `W1` can read every comment on, and post new comments to, any issue in any other workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.
Published: 2026-07-21
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The PraisonAI Platform suffers from an Insecure Direct Object Reference that allows a user to read and post comments on issues that belong to any workspace, regardless of ownership or membership. The comment endpoints only verify that the caller is a member of the target workspace but do not check that the specified issue actually belongs to that workspace, enabling an IDOR that can leak sensitive discussion content and inject arbitrary comments into other workspaces.

Affected Systems

The vulnerability exists in MervinPraison praisonai-platform versions prior to 0.1.4. Users of any earlier release are exposed to the risk if they have access to the API.

Risk and Exploitability

The reported CVSS score of 8.1 indicates a high severity of this flaw. With an EPSS score of <1%, the likelihood of automated exploitation is low, and it is not currently listed in the CISA KEV catalog. Attackers would need to be authenticated members of any workspace to exercise the endpoints, so the vector is an authenticated API call; once authenticated, a user can craft requests to arbitrary issue IDs across workspaces to read or write comments.

Generated by OpenCVE AI on July 30, 2026 at 16:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the PraisonAI Platform to version 0.1.4 or later, which addresses the IDOR by validating that the issue belongs to the specified workspace.
  • If an upgrade cannot be performed immediately, implement a temporary access control layer that verifies the relationship between workspace_id and issue_id before allowing comment read or write operations.
  • Audit existing comment activity logs for unauthorized cross‑workspace posting or reading, and temporarily block or review accounts that exhibit such behavior until the patch can be applied.

Generated by OpenCVE AI on July 30, 2026 at 16:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cp4f-5m9r-5jc2 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
History

Mon, 27 Jul 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Mervinpraison
Mervinpraison praisonai
Vendors & Products Mervinpraison
Mervinpraison praisonai

Tue, 21 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Description PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comment endpoints (`POST /workspaces/{workspace_id}/issues/{issue_id}/comments` and `GET .../comments`) gate access on `require_workspace_member(workspace_id)` only, then call `CommentService.create(issue_id=issue_id, ...)` and `CommentService.list_for_issue(issue_id)` without verifying that `issue_id` belongs to `workspace_id`. A user who is a member of any workspace `W1` can read every comment on, and post new comments to, any issue in any other workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.
Title praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Mervinpraison Praisonai
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-21T17:56:44.597Z

Reserved: 2026-05-19T19:37:43.526Z

Link: CVE-2026-47417

cve-icon Vulnrichment

Updated: 2026-07-21T17:56:15.906Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T17:00:07Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key