The PraisonAI Platform API contains two authorization failures that together break workspace isolation. Service‑layer endpoints perform global primary‑key lookups without imposing the workspace boundary, allowing any authenticated user to read, modify, and delete resources in any workspace simply by substituting UUIDs in their requests. Additionally, member‑management endpoints require only a "member" role, enabling any workspace member to promote themselves to owner and remove the original owner. These flaws allow low‑privilege members to exfiltrate data from other workspaces and takeover any workspace they belong to, compromising confidentiality, integrity, and availability.

The affected product is PraisonAI‑Platform by MervinPraison. All releases prior to version 0.1.4 are vulnerable. The issue manifests on all API routes that perform resource lookups (issues, projects) and on member‑management endpoints that adjust roles. Version 0.1.4 includes a patch that eliminates the missing workspace checks in the service layer and enforces minimum role requirements on member changes.

With a CVSS score of 8.8 the vulnerability is considered high severity. Exploitation requires an authenticated user with any workspace membership, which is typically available to legitimate users. The attacker can construct API calls that swap UUIDs to access arbitrary resources, and can elevate their role within a workspace. Because the EPSS score is not available, the current exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the minimal prerequisites and the potential for cross‑workspace data theft imply a significant risk, especially for organizations that expose the API to a large user base.