Insecure Direct Object Reference in PraisonAI Platform by PraisonAI

CVE-2026-47418

What is CVE-2026-47418?

The PraisonAI Platform is susceptible to an Insecure Direct Object Reference vulnerability that allows unauthorized users to access and manipulate projects across different workspaces. This vulnerability arises because the platform's CRUD endpoints fail to properly validate workspace membership before allowing operations on project-related data. Specifically, users can read, modify, delete, or view statistics for projects belonging to other workspaces. To mitigate this issue, users are urged to update to PraisonAI Platform version 0.1.4 or later, which addresses this critical security flaw.

References