Authorization Bypass in PraisonAI Platform Enables Member Removal

CVE-2026-47409

What is CVE-2026-47409?

The PraisonAI Platform is susceptible to an authorization bypass that allows any workspace member to remove other members, including the workspace owner. This occurs through the DELETE /workspaces/{workspace_id}/members/{user_id} endpoint, which incorrectly relies solely on the require_workspace_member check without verifying the roles of the caller or the target, significantly undermining the platform’s access control. Users should update to version 0.1.4 to close this security gap.

References