Authorization Failures in PraisonAI Platform API Affect Workspace Isolation

CVE-2026-48169

What is CVE-2026-48169?

The PraisonAI Platform API contains two significant authorization failures that compromise workspace isolation. In versions prior to 0.1.4, the service layer mishandles primary-key lookups, allowing any authenticated user to access, modify, and remove resources across all workspaces simply by altering UUIDs in API requests. Furthermore, the member management endpoints lack proper role verification, permitting low-privilege members to elevate their roles and gain ownership, potentially leading to unauthorized data access and modifications. This design flaw enables workspace members to exploit cross-workspace data, effectively undermining the integrity and security of the system.

References