EUVD-2026-41367
GHSA-gggm-v68x-qqwv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable IDOR requiring authenticated session (PR:L); integrity-only impact limited to cross-tenant statistics pollution; no confidentiality or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.
AnalysisAI
Cross-tenant authorization bypass in PraisonAI before 0.1.7 allows authenticated users to inject issues into projects belonging to other workspaces by supplying an unvalidated project_id in issue create and update request bodies. The server trusts the client-supplied project_id without verifying it belongs to the workspace identified in the URL, a classic IDOR pattern classified under CWE-639. An attacker can corrupt project statistics aggregation across tenant boundaries, undermining data integrity in multi-tenant deployments. No public exploit code has been identified at time of analysis, and this is not listed in the CISA KEV catalog.
Technical ContextAI
PraisonAI is an AI agent orchestration framework (CPE: cpe:2.3:a:praisonai:praisonai:*:*:*:*:*:*:*:*) that includes project and issue management functionality supporting multi-workspace (multi-tenant) deployments. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the application accepts a caller-supplied project_id parameter in issue create and update API request bodies and performs no server-side validation to confirm that the referenced project belongs to the workspace encoded in the request URL. This allows a user authenticated to Workspace A to reference a project from Workspace B, causing the issue to be associated with the foreign project. The downstream effect is corruption of project statistics aggregation, which likely involves SQL or in-memory aggregation queries that lack workspace-scoped WHERE clauses when rolling up issue counts or metadata.
RemediationAI
Upgrade PraisonAI to version 0.1.7 or later, which introduces server-side validation confirming that a supplied project_id belongs to the workspace specified in the URL before processing issue create or update requests. The fix is documented in the GitHub Security Advisory GHSA-2fjj-qqg8-fg7x at https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-2fjj-qqg8-fg7x. If an immediate upgrade is not feasible, a compensating control is to enforce workspace-scoped API gateway policies that reject requests where the project_id in the request body does not match resources associated with the authenticated user's workspace - this requires WAF or reverse-proxy-level request inspection and may not be achievable without application-layer changes. Audit existing issue records for cross-workspace project_id references to detect prior exploitation or testing activity.
PraisonAI's TypeScript MCP server (npm package `praisonai`, versions 1.5.0 through 1.7.1) exposes an HTTP JSON-RPC trans
WebSocket origin-validation bypass in PraisonAI's Browser Server (praisonai/browser/server.py) before 4.6.58 lets an att
PraisonAI's `praisonai serve` subsystem (agents and unified modes) accepts an `--api-key` CLI flag that is parsed but ne
Unauthenticated remote agent invocation in PraisonAI versions 4.6.34 through 4.6.57 allows any network-reachable caller
SSRF protection bypass in PraisonAI's praisonaiagents library (all versions before 1.6.58) lets low-privileged users rou
Authentication fail-open in PraisonAI's Recipe HTTP server allows unauthenticated remote attackers to invoke recipe exec
Authentication bypass in PraisonAI's AgentServer component exposes all routes - /publish, /events, /info, /health - to u
Arbitrary Python code execution in PraisonAI's workflow include feature allows an attacker who controls a local recipe d
Server-side request forgery in PraisonAI's web_crawl() function (versions 1.5.128-1.6.57) allows an attacker who can inf
Cross-site request forgery against the PraisonAI MCP HTTP-stream transport allows unauthenticated remote attackers to ex
Remote unauthenticated access to PraisonAI's legacy Flask API server allows attackers to execute configured agent workfl
Path traversal in praisonaiagents prior to 1.6.58 allows a low-privileged caller to write arbitrary JSON files to any pr
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today