{
  "affected": [
    {
      "affectedData": [
        {
          "product": "praisonai-platform",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can rewrite the workspace\u0027s `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object \u2014 depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue."
    },
    {
      "lang": "es",
      "value": "Plataforma PraisonAI es la capa de plataforma para el sistema de equipos multiagente PraisonAI. Las versiones anteriores a la 0.1.4 tienen un bypass de autorizaci\u00f3n que permite la manipulaci\u00f3n de metadatos + configuraciones del espacio de trabajo. El endpoint \u201cPATCH /workspaces/{workspace_id}\u201d est\u00e1 restringido solo por \u201crequire_workspace_member(workspace_id)\u201d (por defecto \u201cmin_role=\u2019member\u2019\u201d). Cualquier miembro puede reescribir el \u201cname\u201d, la \u201cdescription\u201d y el blob JSON de \u201csettings\u201d del espacio de trabajo. El campo de \u201csettings\u201d es un objeto JSON de formato libre - dependiendo de qu\u00e9 c\u00f3digo descendente lo lea, esto se convierte en una primitiva de inyecci\u00f3n de configuraci\u00f3n para cualquier configuraci\u00f3n que la plataforma exponga all\u00ed. La versi\u00f3n 0.1.4 de Plataforma PraisonAI aplica un parche al problema."
    }
  ],
  "id": "CVE-2026-47411",
  "lastModified": "2026-10-24T19:10:00.127",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47411",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-21T17:52:15.640262Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T18:16:59.663",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47411"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T14:23:08Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\n**Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can rewrite the workspace\u0027s `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object \u2014 depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there.\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74; `services/workspace_service.py`\u0027s `update()` method.\n**Root cause:** `Depends(require_workspace_member)` resolves to default `min_role=\"member\"`. `WorkspaceService.update(workspace_id, name, description, settings)` writes the new fields to the workspace row without any caller-permission check. The role hierarchy (`MemberService.has_role`) is never consulted.\n\n## Affected Code\n\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74.\n\n```python\n@router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\nasync def update_workspace(\n    workspace_id: str,\n    body: WorkspaceUpdate,\n    user: AuthIdentity = Depends(require_workspace_member),         # \u003c-- BUG: defaults to min_role=\"member\"\n    session: AsyncSession = Depends(get_db),\n):\n    ws_svc = WorkspaceService(session)\n    ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)  # \u003c-- writes any value\n    if ws is None:\n        raise HTTPException(status_code=404, detail=\"Workspace not found\")\n    return WorkspaceResponse.model_validate(ws)\n```\n\n**Why it\u0027s wrong:** workspace name and settings are owner-tier fields. Renaming the workspace to a profanity is a low-impact griefing vector; rewriting the JSON `settings` blob is potentially a much higher-impact configuration injection (depending on what fields downstream code reads from `settings`, the attacker may flip feature flags, redirect webhook URLs, change LLM provider keys for shared configs, disable audit logging, etc.). The `require_workspace_member(min_role)` parameter is implemented and unused. This endpoint should require owner.\n\n## Exploit Chain\n\n1. Attacker is a member of workspace `W` with role \"member\". State: attacker holds JWT.\n2. Attacker sends `PATCH /workspaces/W` with `Authorization: Bearer \u003cattacker_jwt\u003e` and body `{\"name\": \"Compromised\", \"description\": \"Owned by attacker\", \"settings\": {\"allow_public_invite\": true, \"ai_provider_url\": \"https://attacker.example/v1\"}}`. State: control flow enters `update_workspace`.\n3. `require_workspace_member(W, attacker)` passes. `WorkspaceService.update(W, ...)` writes the three fields. State: workspace `W` now has attacker-chosen name, description, and settings.\n4. The settings JSON is read by any downstream code that consults workspace settings (LLM proxying, invite flows, webhook routing). If the deployment uses settings-keyed configuration overrides, those overrides now point at attacker-controlled endpoints.\n5. Final state: with one member-level token plus one PATCH, the attacker rewrites the workspace\u0027s metadata and settings, with effects ranging from cosmetic (rename) to substantive (settings-keyed config injection).\n\n## Security Impact\n\n**Severity:** sec-moderate. CVSS 6.5: network attack, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality directly (though settings rewrites may enable indirect data exfiltration via attacker-pointed integration URLs), high integrity, no availability claim.\n**Attacker capability:** rewrite any workspace\u0027s name, description, and settings JSON. The actual blast radius depends on what fields the deployment reads from `settings` \u2014 but that field is documented as a free-form JSON blob, so any future configuration the platform adds there becomes attacker-tunable.\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; attacker has any membership token in the target workspace.\n**Differential:** source-inspection-verified. With the suggested fix below, member-tier tokens fail the gate and the metadata rewrite is rejected with 403.\n\n## Suggested Fix\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n+++ b/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n@@ -63,11 +63,11 @@\n @router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\n async def update_workspace(\n     workspace_id: str,\n     body: WorkspaceUpdate,\n-    user: AuthIdentity = Depends(require_workspace_member),\n+    user: AuthIdentity = Depends(_require_workspace_owner),  # see member-update-role advisory for helper\n     session: AsyncSession = Depends(get_db),\n ):\n     ws_svc = WorkspaceService(session)\n     ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)\n     if ws is None:\n         raise HTTPException(status_code=404, detail=\"Workspace not found\")\n     return WorkspaceResponse.model_validate(ws)\n```\n\nDefence-in-depth: validate the keys allowed in `body.settings` against an allowlist so the field cannot become an arbitrary config-injection primitive even for owners. The four companion workspace-mutation endpoints (`add_member`, `update_member_role`, `remove_member`, `delete_workspace`) exhibit the same default-min-role gap and are filed as their own advisories.",
  "id": "GHSA-rcmc-q9rj-4wmq",
  "modified": "2026-06-01T14:23:08Z",
  "published": "2026-06-01T14:23:08Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform",
        "purl": "pkg:pypi/praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.1.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47411",
    "GHSA-rcmc-q9rj-4wmq"
  ],
  "details": "## Summary\n\n**Type:** Authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role=\"member\"`). Any member can rewrite the workspace\u0027s `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object \u2014 depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there.\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74; `services/workspace_service.py`\u0027s `update()` method.\n**Root cause:** `Depends(require_workspace_member)` resolves to default `min_role=\"member\"`. `WorkspaceService.update(workspace_id, name, description, settings)` writes the new fields to the workspace row without any caller-permission check. The role hierarchy (`MemberService.has_role`) is never consulted.\n\n## Affected Code\n\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/workspaces.py`, lines 63-74.\n\n```python\n@router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\nasync def update_workspace(\n    workspace_id: str,\n    body: WorkspaceUpdate,\n    user: AuthIdentity = Depends(require_workspace_member),         # \u003c-- BUG: defaults to min_role=\"member\"\n    session: AsyncSession = Depends(get_db),\n):\n    ws_svc = WorkspaceService(session)\n    ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)  # \u003c-- writes any value\n    if ws is None:\n        raise HTTPException(status_code=404, detail=\"Workspace not found\")\n    return WorkspaceResponse.model_validate(ws)\n```\n\n**Why it\u0027s wrong:** workspace name and settings are owner-tier fields. Renaming the workspace to a profanity is a low-impact griefing vector; rewriting the JSON `settings` blob is potentially a much higher-impact configuration injection (depending on what fields downstream code reads from `settings`, the attacker may flip feature flags, redirect webhook URLs, change LLM provider keys for shared configs, disable audit logging, etc.). The `require_workspace_member(min_role)` parameter is implemented and unused. This endpoint should require owner.\n\n## Exploit Chain\n\n1. Attacker is a member of workspace `W` with role \"member\". State: attacker holds JWT.\n2. Attacker sends `PATCH /workspaces/W` with `Authorization: Bearer \u003cattacker_jwt\u003e` and body `{\"name\": \"Compromised\", \"description\": \"Owned by attacker\", \"settings\": {\"allow_public_invite\": true, \"ai_provider_url\": \"https://attacker.example/v1\"}}`. State: control flow enters `update_workspace`.\n3. `require_workspace_member(W, attacker)` passes. `WorkspaceService.update(W, ...)` writes the three fields. State: workspace `W` now has attacker-chosen name, description, and settings.\n4. The settings JSON is read by any downstream code that consults workspace settings (LLM proxying, invite flows, webhook routing). If the deployment uses settings-keyed configuration overrides, those overrides now point at attacker-controlled endpoints.\n5. Final state: with one member-level token plus one PATCH, the attacker rewrites the workspace\u0027s metadata and settings, with effects ranging from cosmetic (rename) to substantive (settings-keyed config injection).\n\n## Security Impact\n\n**Severity:** sec-moderate. CVSS 6.5: network attack, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality directly (though settings rewrites may enable indirect data exfiltration via attacker-pointed integration URLs), high integrity, no availability claim.\n**Attacker capability:** rewrite any workspace\u0027s name, description, and settings JSON. The actual blast radius depends on what fields the deployment reads from `settings` \u2014 but that field is documented as a free-form JSON blob, so any future configuration the platform adds there becomes attacker-tunable.\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; attacker has any membership token in the target workspace.\n**Differential:** source-inspection-verified. With the suggested fix below, member-tier tokens fail the gate and the metadata rewrite is rejected with 403.\n\n## Suggested Fix\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n+++ b/src/praisonai-platform/praisonai_platform/api/routes/workspaces.py\n@@ -63,11 +63,11 @@\n @router.patch(\"/{workspace_id}\", response_model=WorkspaceResponse)\n async def update_workspace(\n     workspace_id: str,\n     body: WorkspaceUpdate,\n-    user: AuthIdentity = Depends(require_workspace_member),\n+    user: AuthIdentity = Depends(_require_workspace_owner),  # see member-update-role advisory for helper\n     session: AsyncSession = Depends(get_db),\n ):\n     ws_svc = WorkspaceService(session)\n     ws = await ws_svc.update(workspace_id, body.name, body.description, body.settings)\n     if ws is None:\n         raise HTTPException(status_code=404, detail=\"Workspace not found\")\n     return WorkspaceResponse.model_validate(ws)\n```\n\nDefence-in-depth: validate the keys allowed in `body.settings` against an allowlist so the field cannot become an arbitrary config-injection primitive even for owners. The four companion workspace-mutation endpoints (`add_member`, `update_member_role`, `remove_member`, `delete_workspace`) exhibit the same default-min-role gap and are filed as their own advisories.",
  "id": "PYSEC-2026-2937",
  "modified": "2026-07-13T16:05:38.312807Z",
  "published": "2026-07-13T15:35:23.490169Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai-platform"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-rcmc-q9rj-4wmq"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47411"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}"
}