CVE-2026-47414

Summary

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — PATCH /workspaces/{workspace_id}/labels/{label_id}, DELETE .../labels/{label_id}, POST .../issues/{issue_id}/labels/{label_id}, DELETE .../issues/{issue_id}/labels/{label_id}, GET .../issues/{issue_id}/labels — gate access on require_workspace_member(workspace_id) only and pass URL-supplied label_id and issue_id straight through to LabelService without verifying either belongs to the workspace. PraisonAI Platform version 0.1.4 patches the issue.

Affected Software

VendorProductVersion RangeStatus
MervinPraisonpraisonai-platform< 0.1.4affected

Weaknesses

  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

References