PraisonAI before version 0.1.7 does not verify that the project_id supplied in an issue creation or update request matches the workspace specified in the URL. This allows an authenticated actor to create or modify an issue that references a project belonging to another workspace, resulting in cross‑tenant contamination of project statistics. The flaw therefore undermines data integrity and can indirectly degrade confidentiality by producing misleading aggregate views for administrators.

All installations of PraisonAI running a version earlier than 0.1.7 are vulnerable. The defect resides in the issue management API, which accepts a project_id in the request body without enforcing workspace boundaries.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % reflects a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The description does not explicitly state authentication requirements; however, the issue create and update endpoints are normally protected, so it is inferred that the attacker must first authenticate. An attacker would then supply a foreign project_id in the payload, causing cross‑workspace data to pollute aggregated statistics without enabling code execution or broader system compromise.