praisonal-platform Authorization Bypass: Workspace Deletion via Low-Privilege Member Role

Vulnerability Overview Vulnerability Name: praisonal-platform: Any workspace member can delete the entire workspace via Vulnerability Type: Authorization Bypass Vulnerability Description: Vulnerable Endpoint: The endpoint is protected only by , with the default role being . Any member can trigger a request to remove the entire workspace, including all projects, issues, comments, agents, tags, and member records (via cascade from foreign key relationships). There is no owner-role gating, confirmation tokens, soft-delete window, or recovery path. Root Cause: The route uses with a default , which is never overridden. The service method performs destructive operations without verifying the caller's permissions. The role hierarchy ( , lines 50-56) is implemented but not utilized for this endpoint. Scope of Impact Affected Versions: Fixed Versions: CVSS Score: 8.1 / 10 Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: High Remediation Recommended Fix: 1. Code Modification: - In the file , replace with . - Example Code: 2. Additional Security Measures: - Require a confirmation parameter (e.g., body ) and implement a 30-day soft-delete and recovery feature. - The other four workspace mutation endpoints ( , , , ) have the same default non-owner role vulnerability and have been submitted as separate recommendations. Proof of Concept (POC) Code Exploitation Chain 1. The attacker is a member of workspace W (joined via invitation, default registration, or any other route adding membership). Status: The attacker holds a JWT containing . 2. The attacker sends a request with . Status: Control flow enters . 3. passes (the attacker is a member, and the default minimum role "member" is satisfied). removes the workspace row; SQLAlchemy cascade rules delete all related rows (members, issues, projects, comments, agents, tags). Status: Workspace W no longer exists. 4. Final State: A low-privilege attacker has deleted the workspace. The legitimate owner has no recovery path; no soft delete exists; no audit events are generated. For deletion activity logs may have been deleted as part of the cascade. The same primitive becomes a multi-tenant destruction tool at scale (scripts iterate through each workspace ID; the attacker can enumerate them). Security Impact Severity: High, CVSS 8.1: Network attack, low complexity, low privileges, no user interaction, scope unchanged, confidentiality impact none (integrity only), integrity impact high (each workspace child is deleted), availability impact high (workspace requestsor is affected for the legitimate owner). Attacker Capabilities: With just a workspace member token and one DELETE request, the attacker can irreversibly delete the workspace and every sub-resource. The deletion is silent and immediate. Prerequisites: praisonal-platform is deployed as multi-tenant; the attacker possesses a member token for the target workspace. Discrepancy: Source code review reveals the gap. The adjustable parameter of and the fact that this endpoint uses the default value confirm the issue. The recommended fix blocks member tokens before the endpoint, preventing the destructive operation from ever reaching the service layer, and the endpoint returns 403 instead of 204.

Goal Reached Thanks to every supporter — we hit 100%!

praisonal-platform Authorization Bypass: Workspace Deletion via Low-Privilege Member Role

More from this source