CVE-2026-47413: PraisonAI member can escalate to

Q: Is CVE-2026-47413 actively exploited?

No confirmed active exploitation of CVE-2026-47413 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47413?

1. PATCH IMMEDIATELY: Upgrade praisonai-platform to version 0.1.4, which gates POST /workspaces/{id}/members on owner-level authentication via require_workspace_member(min_role='owner'). 2. AUDIT: Query your database for workspace members with 'owner' role — cross-reference against known legitimate owners and revoke any unexpected entries added since deployment. 3. DETECT: Implement logging and alerting for all POST /workspaces/*/members API calls; alert on any request where the authenticated caller is not already an owner of that workspace. 4. ROTATE CREDENTIALS: Any workspace where unauthorized owner accounts may have been injected should be treated as fully compromised — rotate all API keys, tokens, and credentials stored in workspace configuration. 5. REVIEW RELATED ENDPOINTS: The advisory notes that update_workspace, delete_workspace, update_member_role, and remove_member share the same default min_role gap; verify all are remediated in 0.1.4 before considering the attack surface closed.

Q: What systems are affected by CVE-2026-47413?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-tenant AI platforms, Agent configuration management.

Q: What is the CVSS score for CVE-2026-47413?

CVE-2026-47413 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.36%.

CISO Take

A critical authorization flaw in praisonai-platform allows any workspace member to escalate their account—or a fresh attacker-controlled identity—to workspace owner with a single POST request, bypassing every owner-gated operation in the platform. The vulnerability carries a CVSS score of 9.1 with no user interaction required and low exploitation complexity, meaning any member-level credential is sufficient to fully compromise a workspace. With 65 other CVEs recorded in the same package, this pattern of missing authorization checks appears systemic rather than isolated, amplifying risk across all multi-tenant PraisonAI deployments. Teams running praisonai-platform should upgrade immediately to version 0.1.4, audit all workspace owner memberships for unexpected accounts, and review API logs for POST /workspaces/*/members calls originating from non-owner tokens.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CRITICAL. CVSS 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Network-exploitable with low privileges and zero user interaction required. Any authenticated workspace member can achieve full workspace ownership via a single unauthenticated privilege escalation call. The scope change (S:C) reflects that the escalated owner identity is a distinct security principal from the attacker's original member account, enabling lateral movement and attribution evasion. The presence of 65 prior CVEs in the same package strongly suggests systemic authorization gaps across the broader codebase rather than an isolated oversight. Not yet in CISA KEV, but trivial exploitation complexity means weaponization by low-sophistication actors is highly probable in the near term.

How does the attack unfold?

Initial Access

Attacker obtains a valid member-level JWT token for the target workspace via legitimate access (contractor, vendor) or credential compromise of any existing member.

AML.T0012

Account Establishment

Attacker registers a second attacker-controlled account on the platform using open registration, obtaining a user_id that will receive the escalated privilege.

AML.T0021

Privilege Escalation

Using the member-level token, attacker sends POST /workspaces/{id}/members with the new account's user_id and role='owner'; the missing authorization check writes the owner row unconditionally without verifying the caller's right to assign that role.

AML.T0049

Full Workspace Takeover

Attacker authenticates as the new owner account and gains complete control over workspace settings, agent configurations, stored API credentials, and member roster — while audit logs attribute the escalation to the original member account, enabling deniability.

AML.T0081

Initial Access

Attacker obtains a valid member-level JWT token for the target workspace via legitimate access (contractor, vendor) or credential compromise of any existing member.

AML.T0012

Account Establishment

Attacker registers a second attacker-controlled account on the platform using open registration, obtaining a user_id that will receive the escalated privilege.

AML.T0021

Privilege Escalation

Using the member-level token, attacker sends POST /workspaces/{id}/members with the new account's user_id and role='owner'; the missing authorization check writes the owner row unconditionally without verifying the caller's right to assign that role.

AML.T0049

Full Workspace Takeover

Attacker authenticates as the new owner account and gains complete control over workspace settings, agent configurations, stored API credentials, and member roster — while audit logs attribute the escalation to the original member account, enabling deniability.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A None

What should I do?

5 steps

PATCH IMMEDIATELY

Upgrade praisonai-platform to version 0.1.4, which gates POST /workspaces/{id}/members on owner-level authentication via require_workspace_member(min_role='owner').
AUDIT

Query your database for workspace members with 'owner' role — cross-reference against known legitimate owners and revoke any unexpected entries added since deployment.
DETECT

Implement logging and alerting for all POST /workspaces/*/members API calls; alert on any request where the authenticated caller is not already an owner of that workspace.
ROTATE CREDENTIALS

Any workspace where unauthorized owner accounts may have been injected should be treated as fully compromised — rotate all API keys, tokens, and credentials stored in workspace configuration.
REVIEW RELATED ENDPOINTS

The advisory notes that update_workspace, delete_workspace, update_member_role, and remove_member share the same default min_role gap; verify all are remediated in 0.1.4 before considering the attack surface closed.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0021 - Establish Accounts AML.T0049 - Exploit Public-Facing Application AML.T0081 - Modify AI Agent Configuration AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - Access control for AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures are in place for secure deployment and operation of AI systems

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47413?

A critical authorization flaw in praisonai-platform allows any workspace member to escalate their account—or a fresh attacker-controlled identity—to workspace owner with a single POST request, bypassing every owner-gated operation in the platform. The vulnerability carries a CVSS score of 9.1 with no user interaction required and low exploitation complexity, meaning any member-level credential is sufficient to fully compromise a workspace. With 65 other CVEs recorded in the same package, this pattern of missing authorization checks appears systemic rather than isolated, amplifying risk across all multi-tenant PraisonAI deployments. Teams running praisonai-platform should upgrade immediately to version 0.1.4, audit all workspace owner memberships for unexpected accounts, and review API logs for POST /workspaces/*/members calls originating from non-owner tokens.

Is CVE-2026-47413 actively exploited?

No confirmed active exploitation of CVE-2026-47413 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47413?

1. PATCH IMMEDIATELY: Upgrade praisonai-platform to version 0.1.4, which gates POST /workspaces/{id}/members on owner-level authentication via require_workspace_member(min_role='owner'). 2. AUDIT: Query your database for workspace members with 'owner' role — cross-reference against known legitimate owners and revoke any unexpected entries added since deployment. 3. DETECT: Implement logging and alerting for all POST /workspaces/*/members API calls; alert on any request where the authenticated caller is not already an owner of that workspace. 4. ROTATE CREDENTIALS: Any workspace where unauthorized owner accounts may have been injected should be treated as fully compromised — rotate all API keys, tokens, and credentials stored in workspace configuration. 5. REVIEW RELATED ENDPOINTS: The advisory notes that update_workspace, delete_workspace, update_member_role, and remove_member share the same default min_role gap; verify all are remediated in 0.1.4 before considering the attack surface closed.

What systems are affected by CVE-2026-47413?

This vulnerability affects the following AI/ML architecture patterns: AI agent frameworks, Multi-tenant AI platforms, Agent configuration management.

What is the CVSS score for CVE-2026-47413?

CVE-2026-47413 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

AI agent frameworksMulti-tenant AI platformsAgent configuration management

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0021 Establish Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0081 Modify AI Agent Configuration

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`) and forwards the request body's `user_id` and `role` straight into `MemberService.add(workspace_id, user_id, role)`, which has no caller-permission check. A user with the lowest workspace privilege can add any user (including a new attacker-controlled second account, or an existing account they want to grief) as owner of the workspace. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker working as a legitimate contractor or supply-chain vendor obtains member-level access to a target organization's PraisonAI workspace containing production AI agent configurations, API keys, and proprietary tool integrations. Using their member JWT token, they register a second account under a neutral email address and send POST /workspaces/{target_id}/members with body {"user_id": "<new_account_id>", "role": "owner"}. The platform accepts the request and writes the owner row without any authorization check. The attacker authenticates as the new owner account, exports agent configurations and stored credentials, modifies agent system prompts to include silent data exfiltration instructions, and removes their original member account to reduce the visible audit trail. The original workspace owners observe 'contractor-account added external-account as owner' in logs — an entry that may appear routine if the contractor engagement was recent — giving the attacker a substantial dwell-time advantage.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-269 Improper Privilege Management CWE-862 Missing Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.