CVE-2026-48169: PraisonAI IDOR — HIGH

Q: Is CVE-2026-48169 actively exploited?

No confirmed active exploitation of CVE-2026-48169 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-48169?

1. Patch: Upgrade praisonai-platform to ≥0.1.4 immediately — this is the only complete fix. 2. Audit memberships: Query workspace member tables for any role='owner' entries where the user was not the workspace creator; treat unexpected owner accounts as active compromise. 3. Network controls: If patching is delayed, restrict API access to trusted IP ranges or require VPN for all /api/v1/workspaces/* endpoints. 4. Detection: Enable API logging and alert on responses where the workspace_id in the response body differs from the workspace_id in the request URL path; also alert on PATCH /workspaces/{id}/members/* calls from non-owner accounts. 5. Incident response: Rotate all credentials, API keys, and secrets stored within affected workspace issues or projects, as these must be treated as compromised.

Q: What systems are affected by CVE-2026-48169?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, Multi-tenant SaaS deployments, Collaborative AI workspaces, Agent orchestration frameworks.

Q: What is the CVSS score for CVE-2026-48169?

CVE-2026-48169 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.26%.

CISO Take

PraisonAI Platform (≤0.1.2) exposes two chained authorization failures: a service-layer IDOR that lets any authenticated user read, modify, and delete data across all workspace boundaries by swapping resource UUIDs, and a missing role-enforcement gap that lets any workspace member self-promote to owner and expel the original owner with no recovery path. The blast radius is platform-wide — every tenant's AI agent configurations, project data, and operational details are accessible to any valid account holder, breaking multi-tenancy entirely. Although not in CISA KEV and EPSS data is unavailable, the advisory includes a complete working PoC requiring only low-privilege credentials and standard HTTP requests, and the 59 prior CVEs in the same package signal a pattern of authorization weaknesses in this codebase. Upgrade to praisonai-platform 0.1.4 immediately, audit all workspace owner memberships for unexpected promotions, and treat any ownership changes since deployment as potential indicators of compromise.

Sources: GitHub Advisory NVD ATLAS

What is the risk?

HIGH risk. CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) means this is remotely exploitable by any low-privilege authenticated user with no interaction required. Multi-tenant isolation is completely nullified — a single malicious or compromised low-privilege account can enumerate and exfiltrate all workspace data platform-wide. The privilege escalation is irreversible without direct database intervention, as there is no super-admin role and no last-owner protection. Exploitation requires no specialized AI or security knowledge; the PoC is curl commands. The 59 other CVEs in this package family suggest systemic authorization hygiene issues that may extend beyond the patched paths.

How does the attack unfold?

Initial Access

Attacker registers a valid account on the PraisonAI Platform or accepts an invite to any workspace, establishing a legitimate low-privilege member credential.

AML.T0012

Cross-Workspace IDOR

Attacker substitutes resource UUIDs from their own workspace into API requests scoped to any workspace, bypassing the service-layer workspace filter to read, modify, or delete issues and projects across all tenants.

AML.T0049

Privilege Escalation

Using a PATCH /members/{self_id} call with member-level credentials, attacker promotes themselves to owner, then issues DELETE /members/{owner_id} to permanently remove the legitimate workspace owner.

AML.T0049

Impact

Attacker exfiltrates all workspace data including AI agent configurations, credentials, and operational details; legitimate owner is permanently locked out with no platform-level recovery mechanism.

AML.T0025

Initial Access

Attacker registers a valid account on the PraisonAI Platform or accepts an invite to any workspace, establishing a legitimate low-privilege member credential.

AML.T0012

Cross-Workspace IDOR

Attacker substitutes resource UUIDs from their own workspace into API requests scoped to any workspace, bypassing the service-layer workspace filter to read, modify, or delete issues and projects across all tenants.

AML.T0049

Privilege Escalation

Using a PATCH /members/{self_id} call with member-level credentials, attacker promotes themselves to owner, then issues DELETE /members/{owner_id} to permanently remove the legitimate workspace owner.

AML.T0049

Impact

Attacker exfiltrates all workspace data including AI agent configurations, credentials, and operational details; legitimate owner is permanently locked out with no platform-level recovery mechanism.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
PraisonAI	pip	—	No patch
1 dependents 68% patched ~14d to patch Full package profile →
PraisonAI	pip	<= 0.1.2	`0.1.4`
1 dependents 68% patched ~14d to patch Full package profile →

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 18% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Upgrade praisonai-platform to ≥0.1.4 immediately — this is the only complete fix.
Audit memberships: Query workspace member tables for any role='owner' entries where the user was not the workspace creator; treat unexpected owner accounts as active compromise.
Network controls: If patching is delayed, restrict API access to trusted IP ranges or require VPN for all /api/v1/workspaces/* endpoints.
Detection: Enable API logging and alert on responses where the workspace_id in the response body differs from the workspace_id in the request URL path; also alert on PATCH /workspaces/{id}/members/* calls from non-owner accounts.
Incident response: Rotate all credentials, API keys, and secrets stored within affected workspace issues or projects, as these must be treated as compromised.

How is it classified?

Auth Bypass Data Extraction Privacy Violation Agent Framework API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0048.003 - User Harm AML.T0049 - Exploit Public-Facing Application AML.T0085 - Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 12 - Record-keeping Article 9 - Risk management system

ISO 42001

A.6.2 - Data for AI systems — access control A.9.3 - AI system operational monitoring

NIST AI RMF

GOVERN 1.2 - Accountability and oversight MANAGE 2.4 - Residual risks are managed

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-48169?

PraisonAI Platform (≤0.1.2) exposes two chained authorization failures: a service-layer IDOR that lets any authenticated user read, modify, and delete data across all workspace boundaries by swapping resource UUIDs, and a missing role-enforcement gap that lets any workspace member self-promote to owner and expel the original owner with no recovery path. The blast radius is platform-wide — every tenant's AI agent configurations, project data, and operational details are accessible to any valid account holder, breaking multi-tenancy entirely. Although not in CISA KEV and EPSS data is unavailable, the advisory includes a complete working PoC requiring only low-privilege credentials and standard HTTP requests, and the 59 prior CVEs in the same package signal a pattern of authorization weaknesses in this codebase. Upgrade to praisonai-platform 0.1.4 immediately, audit all workspace owner memberships for unexpected promotions, and treat any ownership changes since deployment as potential indicators of compromise.

Is CVE-2026-48169 actively exploited?

No confirmed active exploitation of CVE-2026-48169 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-48169?

1. Patch: Upgrade praisonai-platform to ≥0.1.4 immediately — this is the only complete fix. 2. Audit memberships: Query workspace member tables for any role='owner' entries where the user was not the workspace creator; treat unexpected owner accounts as active compromise. 3. Network controls: If patching is delayed, restrict API access to trusted IP ranges or require VPN for all /api/v1/workspaces/* endpoints. 4. Detection: Enable API logging and alert on responses where the workspace_id in the response body differs from the workspace_id in the request URL path; also alert on PATCH /workspaces/{id}/members/* calls from non-owner accounts. 5. Incident response: Rotate all credentials, API keys, and secrets stored within affected workspace issues or projects, as these must be treated as compromised.

What systems are affected by CVE-2026-48169?

This vulnerability affects the following AI/ML architecture patterns: AI agent platforms, Multi-tenant SaaS deployments, Collaborative AI workspaces, Agent orchestration frameworks.

What is the CVSS score for CVE-2026-48169?

CVE-2026-48169 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

AI agent platformsMulti-tenant SaaS deploymentsCollaborative AI workspacesAgent orchestration frameworks

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0048.003 User Harm

AML.T0049 Exploit Public-Facing Application

AML.T0085 Data from AI Services

Compliance Controls Affected

EU AI Act: Article 12, Article 9

ISO 42001: A.6.2, A.9.3

NIST AI RMF: GOVERN 1.2, MANAGE 2.4

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role="member"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.

Exploitation Scenario

An adversary joins a target PraisonAI Platform instance as a member of any workspace — either by registration or by accepting an invite. They observe resource UUIDs (issue IDs, project IDs) from their own workspace in API responses, then replay GET and PATCH requests against those same routes substituting UUIDs from other workspaces they enumerate or guess. The service layer performs a global primary-key lookup with no workspace filter, returning confidential AI agent configurations, system prompts, API credentials, and M&A or operational data stored as issues in unrelated tenants. If the adversary is subsequently invited as a member to any specific high-value workspace, they issue a single PATCH /workspaces/{id}/members/{self_id} call with role='owner', follow with DELETE /workspaces/{id}/members/{owner_id} to remove the legitimate owner, and assume permanent sole ownership of the workspace and all its AI agent tooling.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-862 Missing Authorization

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.