Authorization Bypass in PraisonAI Platform Affects Configuration Settings
CVE-2026-47411

6.5MEDIUM

Key Information:

Vendor

Mervinpraison

Status
Praisonai-platform
Vendor
CVE Published:
21 July 2026

What is CVE-2026-47411?

The PraisonAI Platform has a significant vulnerability that allows any member of a workspace to bypass authorization restrictions. Specifically, versions before 0.1.4 are impacted by an authorization flaw related to the endpoint PATCH /workspaces/{workspace_id}. This vulnerability enables an attacker with minimal permissions to alter crucial workspace metadata such as its name, description, and settings. The settings field, being a free-form JSON object, can lead to configuration injection and manipulation of various settings exposed by the platform. The issue was resolved in version 0.1.4.

Affected Version(s)

praisonai-platform < 0.1.4

References

https://github.com/MervinPraison/PraisonAI/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.