Vertical Privilege Escalation in PraisonAI Platform by Mervin Praison

CVE-2026-47416

What is CVE-2026-47416?

The PraisonAI Platform, integral to multi-agent systems, is susceptible to vertical privilege escalation. This vulnerability exists in versions prior to 0.1.4, where the critical endpoint PATCH /workspaces/{workspace_id}/members/{user_id} lacks adequate permission checks. Despite being gated by require_workspace_member(workspace_id), which defaults to a minimum role of 'member', the absence of additional validations allows users to elevate their roles unchecked. An attacker could exploit this to gain unauthorized access or control over workspace member roles, compromising the integrity of the system. Version 0.1.4 has addressed this vulnerability by implementing necessary checks.

References