CVE-2026-48169— PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Quick assessment
Affected
MervinPraison praisonai-platform
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Mervin Praison PraisonAI是Mervin Praison个人开发者的一款消息队列软件。 Mervin Praison PraisonAI 0.1.4之前版本存在授权问题漏洞，该漏洞源于服务层未检查工作区所有权和调用者角色级别，可能导致任何已认证用户读取、修改、删除任意工作区资源，以及任意工作区成员提升权限为所有者并接管工作区。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| MervinPraison | praisonai-platform | < 0.1.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-48169
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Source: CVE Program / CVE List V5
Vulnerability Description
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any authenticated user can read, modify, and delete resources in any workspace just by swapping UUIDs in their API requests. On top of that, every member management endpoint (add, update role, remove) only requires `min_role="member"`, which lets any workspace member promote themselves to owner and kick out the original owner. A low-privilege member of one workspace can steal data from every other workspace and take over any workspace they belong to. Both issues come from the same gap: the route layer pulls `workspace_id` from the URL and verifies membership, but the service layer ignores the workspace scope for resource lookups and ignores the caller's role level for member operations. The `require_workspace_member()` dependency does its job correctly. The problem is that the service layer doesn't use the information it provides. Version 0.1.4 of the PraisonAI Platform API patch the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Mervin Praison PraisonAI 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Mervin Praison PraisonAI是Mervin Praison个人开发者的一款消息队列软件。 Mervin Praison PraisonAI 0.1.4之前版本存在授权问题漏洞，该漏洞源于服务层未检查工作区所有权和调用者角色级别，可能导致任何已认证用户读取、修改、删除任意工作区资源，以及任意工作区成员提升权限为所有者并接管工作区。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| MervinPraison | praisonai-platform | < 0.1.4 | - |
|
II. Public POCs for CVE-2026-48169
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Verified env
Premium
Reproduced successfully in a real sandbox
· Below is the actual recording of building the environment and exploiting the vulnerability.
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
claude_code
· 10157 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-48169
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-48169 (2)
IV. Related Vulnerabilities
Same product: praisonai-platform
-
CVE-2026-47419
praisonai-platform: Agent endpoints accept any agent_id with -
CVE-2026-47418
praisonai-platform: Project endpoints accept any project_id -
CVE-2026-47417
praisonai-platform: Comment endpoints accept any issue_id wi -
CVE-2026-47416
praisonai-platform: Any workspace member can promote themsel -
CVE-2026-47415
praisonai-platform: Issue endpoints accept any issue_id with
Same vendor: MervinPraison
-
CVE-2026-55536
Browser Server WebSocket origin validation bypass via unanch -
CVE-2026-55532
PraisonAI: Origin-validation bypass (startswith prefix match -
CVE-2026-55533
PraisonAI: Authentication fail-open in Recipe server allows -
CVE-2026-55539
PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/ -
CVE-2026-55527
PraisonAI: Arbitrary file write via unsanitized `user_id` in
Same weakness: CWE-639
-
CVE-2026-85638
jofpin trape user.py authorization -
CVE-2026-61688
SolidInvoice allows cross-user access to API token request h -
CVE-2026-17627
Langflow is affected by improper authorization due to missin -
CVE-2026-85693
Chatbot UI Cross-User Private File Content Disclosure via Re -
CVE-2026-85624
Blinko 1.8.7 Cross-User Private Note Disclosure via noteRefe
V. Comments for CVE-2026-48169
No comments yet