Privilege escalation via missing role check in PraisonAI platform workspace member API (CVE-2026-47413)

The `POST /workspaces/{workspace_id}/members` endpoint in praisonai-platform only requires the caller to be a workspace member (minimum role) before accepting an arbitrary `user_id` and `role` from the request body. Because `MemberService.add` validates only that the role value is recognized-not that the caller has permission to assign it-any member-level token can promote an arbitrary platform user to workspace owner with a single HTTP request. This grants an attacker full workspace control under a separate identity, bypassing all owner-gated operations. Affected versions: - <= 0.1.2 We recommend updating to: >= 0.1.4. CVSS 9.6 · our assessment: act_now Reference: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-8g2p-pqm3-fcfh Details: https://vuln.today/cve/CVE-2026-47413