CVE-2026-47407: praisonai-platform: IDOR enables cross-tenant agent hijack

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The auth check passes, since they really are a member of the prefix workspace. The service then returns the cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform version 0.1.4 patches the issue.

An attacker registers a free account at /api/v1/auth/register — no email verification, instant bearer token returned. They create a personal workspace, then begin enumerating victim resource UUIDs by iterating UUID patterns or exploiting any predictability in the platform's ID generation. Using their own workspace_id in the URL prefix and a victim's agent_id in the path (GET /api/v1/workspaces/{attacker_ws}/agents/{victim_agent_id}), the auth dependency sees only that the attacker is a member of their own workspace and returns HTTP 200 with the full victim agent object, including API keys embedded in agent.instructions. The attacker then issues a PATCH to overwrite agent.instructions with a malicious prompt that exfiltrates all future conversation turns to an attacker-controlled endpoint — a change that persists invisibly on the victim's workspace. If the attacker was ever legitimately invited as a basic member to a high-value workspace, they additionally PATCH their own role to admin, DELETE the original owner's membership, and assume permanent control of that workspace's full agent fleet.