Authorization Bypass in PraisonAI Platform Allows Destructive Actions

CVE-2026-47412

What is CVE-2026-47412?

The PraisonAI Platform has a significant security flaw that allows any member of a workspace to execute a DELETE action on the entire workspace. This vulnerability, present in versions prior to 0.1.4, enables the immediate deletion of all associated data—including projects, issues, comments, agents, labels, and member records—without any adequate safeguards. There is a lack of a robust owner-role gate, no confirmation mechanism, and no possibility for recovery following deletions, posing a serious risk for data loss and integrity within the platform. Version 0.1.4 addresses this vulnerability by introducing necessary checks.

References