CVE-2026-47413Patch

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, user_id, role)`, which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR137d
Patch
🚨 Critical - PraisonAI Platform Privilege Escalation (CVE-2026-47413) A flaw in PraisonAI Platform allows any workspace member to add arbitrary users as workspace owners via the member management API. An attacker with only member-level access can create or use a second account and instantly gain full ownership of the workspace. Successful exploitation may allow unauthorized access to workspace data, member management, and other owner-restricted actions. 👉 Affected: praisonai-platform < 0.1.4 👉 Fix: Upgrade to 0.1.4
Post summary
The post discloses a privilege escalation flaw in PraisonAI Platform (CVE-2026-47413) and directs users to upgrade to 0.1.4 for a fix.
0000059
197 followersView on X

Explore more

Back to dashboard