Praisonal-platform BOLA vulnerability allows workspace owner lockout

Vulnerability Overview Vulnerability Name: praisonal-platform: Any workspace member can remove any other member (including the owner) via Vulnerability Type: Authorization Bypass Leading to User Lockout Vulnerability Description: The endpoint is only checked for permissions via , with the default role being "member". Any member (including the workspace owner) can remove another member via a single DELETE request. There are no caller permission checks, target role checks, or checks preventing the removal of the last owner. Root Cause: executes the deletion without performing caller permission checks or member permission logic. The route accepts a user-provided and dispatches it directly. The role hierarchy is implemented but never invoked. Member-level tokens can trigger and immediately lock out the legitimate owner. Impact Scope Affected Versions: = 0.1.4 CVSS Score: 8.1 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High Remediation Suggested Fix Code: Other Remediation Suggestions: Ensure caller permission checks are performed when removing members. Add target role checks to prevent removal of owners. Add checks to prevent removing the last owner. Exploit Chain 1. The attacker is a member with the role "member" in workspace . Status: Attacker holds a JWT. 2. The attacker enumerates the of the workspace owner via (this member list has the same default member permissions, requiring no additional permissions). The owner's UUID is known. Status: Attacker holds . 3. The attacker sends with the authorization . Status: Control flow enters . 4. passes (attacker is a member). deletes the owner. Status: no longer exists. 5. The owner attempts to but requires , which returns 403. Status: The legitimate owner is now locked out of their own workspace. 6. Combined with the role upgrade suggestion, the attacker first promotes themselves to owner and then removes the legitimate owner, gaining unrestricted access. Combined with , the attacker can permanently erase the entire workspace after kicking out the owner. 7. Final Status: Using a single member-level token, the attacker permanently locks the legitimate owner out of the workspace. The owner has no other recourse other than database-level intervention. Security Impact Severity: High CVSS 3.1: Network attack vector, low complexity, low privileges, no user interaction, scope unchanged, no confidentiality impact, high integrity impact, high availability impact Attack Capability: A workspace-level member token plus a single DELETE request allows the attacker to permanently lock out any other member (including the workspace owner). Prerequisites: praisonal-platform is deployed in a multi-tenant environment; the attacker has a member-level token; the owner's is accessible via the endpoint. Differentiation: Source verification validation. The asymmetry between the configurable parameter of and the default value used by this endpoint confirms the vulnerability. With the suggested fix, member-level tokens will fail, and attempts to remove the last owner of a workspace will trigger additional guards. Additional Information CVE ID: CVE-2026-47409 Weaknesses: CWE-269, CWE-862

Goal Reached Thanks to every supporter — we hit 100%!

Praisonal-platform BOLA vulnerability allows workspace owner lockout

More from this source