Access Control Flaw in PraisonAI Platform Allows Role Escalation

CVE-2026-47405

What is CVE-2026-47405?

The PraisonAI Platform experiences a significant security flaw due to a broken workspace authorization check. In versions prior to 0.1.4, authenticated low-privilege workspace members can exploit this weakness to escalate their user role to 'owner'. This vulnerability arises from the misuse of the shared dependency 'require_workspace_member(...)', which fails to enforce proper role validation for certain privileged workspace-management routes. Consequently, ordinary members can promote their own accounts to 'owner', add unauthorized users, change roles of existing members, and even remove legitimate members or owners. This flaw poses a risk of complete workspace takeover, allowing the perpetrator to perform destructive actions within the platform.

References