Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

praisonai-platform — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in praisonai-platform, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known security weaknesses for the praisonai-platform product developed by its respective vendor, focusing primarily on software vulnerabilities tagged within the AI infrastructure domain. The collection encompasses a comprehensive range of security issues including code injection flaws, authentication bypasses, and data exposure incidents identified from the platform's initial public release through the current reporting period. Visitors can utilize this resource to track official vendor advisories regarding emerging threats, understand the specific characteristics of weakness classes affecting AI orchestration tools, or review the complete historical vulnerability record for the praisonai-platform to assess its long-term security posture. The data presented here is curated to support security researchers, system administrators, and developers in making informed decisions about risk mitigation and patch management strategies without relying on fragmented external sources. By centralizing these findings, the page facilitates a clearer view of the product's security evolution over time, enabling stakeholders to correlate past incidents with current deployment configurations effectively. This structured aggregation ensures that critical information remains accessible and actionable for all parties responsible for maintaining the integrity and confidentiality of systems utilizing this specific AI platform.

Vendor: MervinPraison

CVE ID Title CVSS Severity Published
CVE-2026-62179 PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues CWE-862 6.5 Medium 2026-10-07
CVE-2026-48169 PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API CWE-639 8.8 High 2026-08-07
CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR CWE-639 8.3 High 2026-07-21
CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR CWE-639 8.1 High 2026-07-21
CVE-2026-47417 praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR CWE-639 8.1 High 2026-07-21
CVE-2026-47416 praisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id} CWE-269 9.6 Critical 2026-07-21
CVE-2026-47415 praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR CWE-639 8.3 High 2026-07-21
CVE-2026-47414 praisonai-platform: Label endpoints accept any label_id and any issue_id without workspace ownership check, cross-workspace label edit/delete and issue-label-link IDOR CWE-639 7.6 High 2026-07-21
CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members CWE-269 9.6 Critical 2026-07-21
CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id} CWE-269 8.1 High 2026-07-21
CVE-2026-47411 praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id} CWE-269 6.5 Medium 2026-07-21
CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset CWE-321 9.8 Critical 2026-07-21
CVE-2026-47409 praisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id} CWE-269 8.1 High 2026-07-21
CVE-2026-47408 praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership CWE-639 6.5 Medium 2026-07-21
CVE-2026-47407 PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation CWE-269 - - 2026-07-21
CVE-2026-47406 praisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOR CWE-639 8.1 High 2026-07-21
CVE-2026-47405 PraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership CWE-284 8.8 High 2026-07-21
CVE-2026-47399 PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID CWE-284 8.8 High 2026-07-21

All 18 known CVE vulnerabilities affecting praisonai-platform with full Chinese analysis, references, and POCs where available.