The PraisonAI Platform provides agent CRUD operations under the path `/workspaces/{workspace_id}/agents/{agent_id}`. Access control checks only verify that the requesting user is a member of the workspace specified in the URL. The platform then looks up the agent by its primary key without applying any workspace filter. As a result, a user who belongs to any workspace can supply an agent UUID from another workspace and read, modify, or delete that agent. This weakness is an Insecure Direct Object Reference (CWE‑639) that can expose or alter data belonging to other workspaces, violating confidentiality, integrity, and potentially availability of cross‑workspace resources.

The vulnerability affects the MervinPraison PraisonAI Platform in all releases prior to version 0.1.4. The issue was fixed in release 0.1.4, which applies an additional workspace‑membership check when resolving the agent identifier.

The CVSS score of 8.3 indicates a high‑severity flaw, with an EPSS score of less than 1 %. The vulnerability is not listed in the CISA KEV catalog. An attacker must be an authenticated workspace member to operate; however, the lack of a workspace constraint on the agent lookup allows lateral movement across workspaces using guessed or harvested UUIDs. The exploit is straightforward to craft once the attacker knows at least one agent UUID from another workspace.