CVE-2026-47416: PraisonAI member-to-owner

Q: Is CVE-2026-47416 actively exploited?

No confirmed active exploitation of CVE-2026-47416 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-47416?

1. PATCH IMMEDIATELY: Upgrade praisonai-platform to >=0.1.4, which corrects the FastAPI dependency misconfiguration by introducing a dedicated _require_owner closure and adds caller-role enforcement inside MemberService.update_role. 2. DETECTION: Query application access logs for PATCH /workspaces/*/members/* requests where the requesting user's prior role was "member" and the response was HTTP 200 with a body indicating role "owner" or "admin" — this is the exact exploit signature. 3. INVESTIGATION: If exploitation is suspected, audit your members table for unexpected owner/admin promotions, especially where the previous owner was simultaneously demoted. Check timestamps for sub-second sequences (two-request lockout pattern). 4. WORKAROUND (if immediate patching is not feasible): Deploy a WAF or API gateway rule blocking PATCH /workspaces/*/members/* for any session token whose current role is below admin; or disable the endpoint until the patch is applied. 5. AUDIT COMPANION ENDPOINTS: Per the advisory, add_member, remove_member, delete_workspace, and update_workspace share the same Depends(require_workspace_member) default pattern — review each for equivalent authorization gaps pending their own CVE assignments.

CISO Take

PraisonAI Platform (<=0.1.2) contains a critical privilege escalation vulnerability where any workspace member can promote themselves to owner with a single HTTP PATCH request due to a FastAPI dependency misconfiguration — the authorization gate always resolves to the minimum "member" role regardless of the intended permission model. No public exploit code is available and it is not in CISA KEV, but with a CVSS score of 9.1, trivial exploitation requiring only one authenticated request, and full workspace takeover potential — including the ability to demote legitimate owners and chain into companion workspace-deletion advisories — urgency is high for any multi-tenant deployment where signup yields automatic workspace membership. Organizations running praisonai-platform must upgrade immediately to version 0.1.4; in the interim, block or WAF-gate PATCH requests to /workspaces/*/members/* for non-owner sessions.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

CRITICAL. CVSS 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). Exploitation requires only a valid member-tier token obtainable through normal onboarding, invite links, or free signup. No brute force, social engineering, or AI/ML knowledge is required — a single HTTP PATCH completes the escalation in one round-trip. The companion advisory family (add_member, remove_member, delete_workspace, update_workspace) shares the same root cause (Depends(require_workspace_member) defaulting to min_role="member"), compounding blast radius significantly. In multi-tenant deployments this is effectively pre-authenticated privilege escalation for any user who can reach the API.

How does the attack unfold?

Initial Access

Attacker obtains a valid workspace member token by registering an account and joining the target workspace via invite link, public signup, or self-enrollment — no elevated privilege required.

AML.T0012

Privilege Escalation

Attacker issues a single PATCH /workspaces/{id}/members/{self_id} with body {"role":"owner"}, exploiting the FastAPI dependency misconfiguration that resolves the authorization gate to min_role="member" for every route.

AML.T0049

Owner Lockout

Attacker sends a second PATCH demoting the legitimate owner to "member" role, preventing recovery while cementing persistent owner-level control over the workspace.

AML.T0081

Impact

Attacker exfiltrates all AI agent configurations, LLM provider API keys, system prompts, tool definitions, and workspace data, then optionally invokes the companion delete_workspace endpoint to destroy forensic evidence.

AML.T0053

Initial Access

Attacker obtains a valid workspace member token by registering an account and joining the target workspace via invite link, public signup, or self-enrollment — no elevated privilege required.

AML.T0012

Privilege Escalation

Attacker issues a single PATCH /workspaces/{id}/members/{self_id} with body {"role":"owner"}, exploiting the FastAPI dependency misconfiguration that resolves the authorization gate to min_role="member" for every route.

AML.T0049

Owner Lockout

Attacker sends a second PATCH demoting the legitimate owner to "member" role, preventing recovery while cementing persistent owner-level control over the workspace.

AML.T0081

Impact

Attacker exfiltrates all AI agent configurations, LLM provider API keys, system prompts, tool definitions, and workspace data, then optionally invokes the companion delete_workspace endpoint to destroy forensic evidence.

AML.T0053

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 69% patched ~13d to patch Full package profile →

Do you use PraisonAI? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A None

What should I do?

5 steps

PATCH IMMEDIATELY

Upgrade praisonai-platform to >=0.1.4, which corrects the FastAPI dependency misconfiguration by introducing a dedicated _require_owner closure and adds caller-role enforcement inside MemberService.update_role.
DETECTION

Query application access logs for PATCH /workspaces/*/members/* requests where the requesting user's prior role was "member" and the response was HTTP 200 with a body indicating role "owner" or "admin" — this is the exact exploit signature.
INVESTIGATION

If exploitation is suspected, audit your members table for unexpected owner/admin promotions, especially where the previous owner was simultaneously demoted. Check timestamps for sub-second sequences (two-request lockout pattern).
WORKAROUND (if immediate patching is not feasible): Deploy a WAF or API gateway rule blocking PATCH /workspaces/*/members/* for any session token whose current role is below admin; or disable the endpoint until the patch is applied.
AUDIT COMPANION ENDPOINTS

Per the advisory, add_member, remove_member, delete_workspace, and update_workspace share the same Depends(require_workspace_member) default pattern — review each for equivalent authorization gaps pending their own CVE assignments.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Extraction Agent Framework AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.1.2 - Information security roles and responsibilities in AI systems

NIST AI RMF

GOVERN 6.1 - Policies and procedures for AI risk response

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-47416?

PraisonAI Platform (<=0.1.2) contains a critical privilege escalation vulnerability where any workspace member can promote themselves to owner with a single HTTP PATCH request due to a FastAPI dependency misconfiguration — the authorization gate always resolves to the minimum "member" role regardless of the intended permission model. No public exploit code is available and it is not in CISA KEV, but with a CVSS score of 9.1, trivial exploitation requiring only one authenticated request, and full workspace takeover potential — including the ability to demote legitimate owners and chain into companion workspace-deletion advisories — urgency is high for any multi-tenant deployment where signup yields automatic workspace membership. Organizations running praisonai-platform must upgrade immediately to version 0.1.4; in the interim, block or WAF-gate PATCH requests to /workspaces/*/members/* for non-owner sessions.

Is CVE-2026-47416 actively exploited?

No confirmed active exploitation of CVE-2026-47416 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-47416?

1. PATCH IMMEDIATELY: Upgrade praisonai-platform to >=0.1.4, which corrects the FastAPI dependency misconfiguration by introducing a dedicated _require_owner closure and adds caller-role enforcement inside MemberService.update_role. 2. DETECTION: Query application access logs for PATCH /workspaces/*/members/* requests where the requesting user's prior role was "member" and the response was HTTP 200 with a body indicating role "owner" or "admin" — this is the exact exploit signature. 3. INVESTIGATION: If exploitation is suspected, audit your members table for unexpected owner/admin promotions, especially where the previous owner was simultaneously demoted. Check timestamps for sub-second sequences (two-request lockout pattern). 4. WORKAROUND (if immediate patching is not feasible): Deploy a WAF or API gateway rule blocking PATCH /workspaces/*/members/* for any session token whose current role is below admin; or disable the endpoint until the patch is applied. 5. AUDIT COMPANION ENDPOINTS: Per the advisory, add_member, remove_member, delete_workspace, and update_workspace share the same Depends(require_workspace_member) default pattern — review each for equivalent authorization gaps pending their own CVE assignments.

What systems are affected by CVE-2026-47416?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, multi-tenant AI platforms, AI agent orchestration.

What is the CVSS score for CVE-2026-47416?

CVE-2026-47416 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksmulti-tenant AI platformsAI agent orchestration

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.1.2

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `require_workspace_member(workspace_id)`, which defaults to `min_role="member"` and is never overridden by the route. The handler then calls `MemberService.update_role(workspace_id, user_id, body.role)` which sets the target member's role to whatever the request body specifies, with no check that the caller has owner-or-admin privilege, no check that the new role is not higher than the caller's own, and no check that the caller is not silently promoting themselves. PraisonAI Platform version 0.1.4 patches the issue.

Exploitation Scenario

An adversary targeting an organization using PraisonAI Platform for internal AI agent orchestration registers a free account and receives an invite to the target workspace as a standard member. Using their valid JWT, they issue one HTTP request: PATCH /workspaces/{target_workspace_id}/members/{their_own_user_id} with body {"role": "owner"}. FastAPI resolves the dependency with the default min_role="member" (satisfied), and MemberService.update_role writes the new role with no caller check. The attacker is now workspace owner in a single round-trip. In a follow-up request they demote the legitimate owner to "member" to prevent recovery. They then exfiltrate all AI agent configurations — including LLM provider API keys, system prompts, and tool definitions stored in workspace settings — and enumerate agent conversation history and connected RAG data sources. Finally they invoke the companion delete_workspace endpoint to destroy forensic evidence before the organization detects the compromise.

Weaknesses (CWE)

CWE-269 Improper Privilege Management Primary CWE-269 Improper Privilege Management Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-269 Improper Privilege Management CWE-862 Missing Authorization

CWE-269 — Improper Privilege Management: The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Follow the principle of least privilege when assigning access rights to entities in a software system.

Source: MITRE CWE corpus.