CVE-2026-47415: PraisonAI IDOR exposes

Q: Is CVE-2026-47415 actively exploited?

No confirmed active exploitation of CVE-2026-47415 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47415?

1. Patch: upgrade praisonai-platform to 0.1.4 which adds workspace_id as a query predicate to IssueService.get(), .update(), and .delete(). 2. Verify scope: the advisory flags the same IDOR pattern in AgentService, ProjectService, CommentService, and LabelService — confirm 0.1.4 addresses all five or apply the composite-key fix (workspace_id AND resource_id) manually to each service. 3. Detection: query activity logs for issue_id values accessed outside their originating workspace_id; given that tamper events are recorded under the attacker's workspace rather than the victim's, cross-reference by issue_id across workspace boundaries. 4. Workaround (if patching is delayed): restrict API access to trusted networks or add a middleware layer that validates the resource's workspace_id matches the URL path parameter before any service method is called. 5. Audit UUIDs: review whether issue UUIDs are exposed in activity feeds, exports, or error messages and consider scoping those outputs to workspace-specific views to reduce reconnaissance surface.

Q: What systems are affected by CVE-2026-47415?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI task and issue management systems.

Q: What is the CVSS score for CVE-2026-47415?

CVE-2026-47415 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.28%.

CISO Take

praisonai-platform before 0.1.4 contains an Insecure Direct Object Reference in its issue management API that allows any authenticated workspace member to read, modify, or delete issues belonging to entirely different tenants — the membership gate validates the attacker's own workspace but the underlying database lookup carries no workspace constraint, so substituting a victim's issue UUID in the request is sufficient to exfiltrate or tamper with it. The blast radius covers every multi-tenant PraisonAI deployment: issue records in AI agent platforms routinely contain confidential bug reports, customer PII, embedded credentials, and agent prompt content, and the 65 prior CVEs in this package signal a persistently underdeveloped security posture that warrants elevated scrutiny. No public exploit code exists and the CVE is not in CISA KEV, but the attack requires only trivial tooling — a valid JWT and a harvested UUID — with UUIDs leaking through activity feeds, comment threads, and exported dumps, placing exploitation well within reach of opportunistic actors. Patch to praisonai-platform 0.1.4 immediately, audit activity logs for cross-workspace issue access patterns, and note that the audit trail records events under the attacker's workspace rather than the victim's, making retrospective detection non-trivial without additional query-level logging.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

High risk in any multi-tenant deployment. Attack complexity is low, privileges required are minimal (any workspace member token), no user interaction is needed, and the vulnerability is remotely exploitable over the network. The write primitive is particularly dangerous: an attacker can not only exfiltrate issue content silently but also corrupt it (false closure, description wipe, project reassignment) and delete it entirely to destroy evidence. The asymmetry between the existing composite-key pattern in MemberService and the unconstrained single-key lookups across IssueService, AgentService, ProjectService, CommentService, and LabelService confirms this is a systemic authorization design gap rather than an isolated oversight. The 65 prior CVEs in the same package increase the probability that related IDOR variants exist in production deployments that have not yet received the 0.1.4 patch.

How does the attack unfold?

Initial Access

Attacker creates a legitimate account and joins a low-privilege workspace (W_attacker) on the multi-tenant PraisonAI deployment using valid credentials.

AML.T0012

UUID Reconnaissance

Attacker harvests target issue UUIDs from activity feeds, comment threads, exported issue dumps, or error messages visible within their own workspace — UUIDs are not secret and surface through multiple side channels.

AML.T0000

IDOR Exploitation

Attacker submits authenticated API requests to /workspaces/W_attacker/issues/{victim_uuid}; the membership gate passes for W_attacker while the unconstrained database lookup returns the victim workspace's full issue record.

AML.T0049

Data Exfiltration and Tampering

Attacker reads confidential issue content including embedded credentials and PII, silently rewrites or deletes victim issues, and evades detection because audit logs attribute all events to the attacker's workspace rather than the victim's.

AML.T0025

Initial Access

Attacker creates a legitimate account and joins a low-privilege workspace (W_attacker) on the multi-tenant PraisonAI deployment using valid credentials.

AML.T0012

UUID Reconnaissance

Attacker harvests target issue UUIDs from activity feeds, comment threads, exported issue dumps, or error messages visible within their own workspace — UUIDs are not secret and surface through multiple side channels.

AML.T0000

IDOR Exploitation

Attacker submits authenticated API requests to /workspaces/W_attacker/issues/{victim_uuid}; the membership gate passes for W_attacker while the unconstrained database lookup returns the victim workspace's full issue record.

AML.T0049

Data Exfiltration and Tampering

Attacker reads confidential issue content including embedded credentials and PII, silently rewrites or deletes victim issues, and evades detection because audit logs attribute all events to the attacker's workspace rather than the victim's.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	< 0.1.4	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A Low

What should I do?

5 steps

Patch: upgrade praisonai-platform to 0.1.4 which adds workspace_id as a query predicate to IssueService.get(), .update(), and .delete().
Verify scope: the advisory flags the same IDOR pattern in AgentService, ProjectService, CommentService, and LabelService — confirm 0.1.4 addresses all five or apply the composite-key fix (workspace_id AND resource_id) manually to each service.
Detection: query activity logs for issue_id values accessed outside their originating workspace_id; given that tamper events are recorded under the attacker's workspace rather than the victim's, cross-reference by issue_id across workspace boundaries.
Workaround (if patching is delayed): restrict API access to trusted networks or add a middleware layer that validates the resource's workspace_id matches the URL path parameter before any service method is called.
Audit UUIDs: review whether issue UUIDs are exposed in activity feeds, exports, or error messages and consider scoping those outputs to workspace-specific views to reduce reconnaissance surface.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent Framework AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0036 - Data from Information Repositories AML.T0049 - Exploit Public-Facing Application AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk management system for high-risk AI

ISO 42001

A.8.1 - AI system data governance and access control

NIST AI RMF

GOVERN-1.7 - Organizational policies for AI risk management

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-47415?

praisonai-platform before 0.1.4 contains an Insecure Direct Object Reference in its issue management API that allows any authenticated workspace member to read, modify, or delete issues belonging to entirely different tenants — the membership gate validates the attacker's own workspace but the underlying database lookup carries no workspace constraint, so substituting a victim's issue UUID in the request is sufficient to exfiltrate or tamper with it. The blast radius covers every multi-tenant PraisonAI deployment: issue records in AI agent platforms routinely contain confidential bug reports, customer PII, embedded credentials, and agent prompt content, and the 65 prior CVEs in this package signal a persistently underdeveloped security posture that warrants elevated scrutiny. No public exploit code exists and the CVE is not in CISA KEV, but the attack requires only trivial tooling — a valid JWT and a harvested UUID — with UUIDs leaking through activity feeds, comment threads, and exported dumps, placing exploitation well within reach of opportunistic actors. Patch to praisonai-platform 0.1.4 immediately, audit activity logs for cross-workspace issue access patterns, and note that the audit trail records events under the attacker's workspace rather than the victim's, making retrospective detection non-trivial without additional query-level logging.

Is CVE-2026-47415 actively exploited?

No confirmed active exploitation of CVE-2026-47415 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47415?

1. Patch: upgrade praisonai-platform to 0.1.4 which adds workspace_id as a query predicate to IssueService.get(), .update(), and .delete(). 2. Verify scope: the advisory flags the same IDOR pattern in AgentService, ProjectService, CommentService, and LabelService — confirm 0.1.4 addresses all five or apply the composite-key fix (workspace_id AND resource_id) manually to each service. 3. Detection: query activity logs for issue_id values accessed outside their originating workspace_id; given that tamper events are recorded under the attacker's workspace rather than the victim's, cross-reference by issue_id across workspace boundaries. 4. Workaround (if patching is delayed): restrict API access to trusted networks or add a middleware layer that validates the resource's workspace_id matches the URL path parameter before any service method is called. 5. Audit UUIDs: review whether issue UUIDs are exposed in activity feeds, exports, or error messages and consider scoping those outputs to workspace-specific views to reduce reconnaissance surface.

What systems are affected by CVE-2026-47415?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI task and issue management systems.

What is the CVSS score for CVE-2026-47415?

CVE-2026-47415 has a CVSS v3.1 base score of 8.3 (HIGH). The EPSS exploitation probability is 0.28%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsAI task and issue management systems

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0036 Data from Information Repositories

AML.T0049 Exploit Public-Facing Application

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Article 9

ISO 42001: A.8.1

NIST AI RMF: GOVERN-1.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issue CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/issues/{issue_id}`) gate access on `require_workspace_member(workspace_id)` only, then resolve `issue_id` through `IssueService.get(issue_id)` which is a primary-key lookup with no workspace constraint. A user who is a member of any workspace `W1` can read, modify, or delete issues that belong to a different workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An attacker operating a threat intelligence or red team engagement against a company using PraisonAI's hosted multi-tenant platform creates a free-tier account and becomes a member of their own workspace (W_attacker). They monitor the platform's activity feed and comment threads within W_attacker, where issue UUIDs from cross-workspace notification events occasionally surface — or they obtain a UUID via an exported issue dump from a shared project they were briefly invited to. Armed with a valid JWT and one victim issue UUID, they send GET /workspaces/W_attacker/issues/{victim_uuid} with their bearer token. The membership check passes for W_attacker, and IssueService.get() performs an unconstrained SELECT returning the full issue row from the victim workspace — including title, description, embedded credentials, assignee identity, and project linkage. They follow with PATCH requests to overwrite the issue's description and close it (suppressing security escalation), then DELETE to eliminate the record entirely. Throughout the attack, the audit trail records all events under W_attacker, leaving the victim workspace's incident log clean.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.