Privilege escalation in PraisonAI praisonai-platform workspace member role endpoint (CVE-2026-47416)

The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint in praisonai-platform performs no authorization check on the caller's role before updating a workspace member's role. Any workspace member, holding the lowest privilege tier, can promote themselves or any other member to "owner" in a single HTTP request, gaining full administrative control of the workspace. Affected versions: - <= 0.1.2 We recommend updating to: >= 0.1.4. CVSS 9.6 · our assessment: act_now Reference: https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-c2m8-4gcg-v22g Details: https://vuln.today/cve/CVE-2026-47416