CVE-2026-48169: 
Python 脆弱性の分析と軽減

CVE-2026-48169 is a Cross-Workspace Insecure Direct Object Reference (IDOR) and Privilege Escalation vulnerability in the PraisonAI Platform API that breaks multi-tenant workspace isolation. It affects praisonai-platform versions <= 0.1.2 (pip package), with a patched version available at >= 0.1.4. The vulnerability was published by MervinPraison on May 19, 2026, and added to the GitHub Advisory Database on May 29, 2026. It carries a CVSS v3.1 base score of 8.8 (High) (GitHub Advisory).

The vulnerability stems from two distinct authorization failures classified as CWE-639 (Authorization Bypass Through User-Controlled Key) and CWE-862 (Missing Authorization). First, the service layer in issue_service.py and project_service.py performs global primary-key lookups via session.get(Model, pk) without any WHERE workspace_id = ? filter, meaning the workspace_id validated at the route layer is never passed to or enforced by the service layer for get(), update(), and delete() operations. Second, all member management endpoints (add, update role, remove) in workspaces.py use the default min_role="member" for the require_workspace_member() dependency, so no route ever enforces min_role="owner" or min_role="admin" — allowing any member to self-promote to owner, modify superiors' roles, or remove the original owner without restriction (GitHub Advisory, PraisonAI Advisory).

Successful exploitation enables a complete multi-tenant data breach: any authenticated user with membership in any single workspace can read, modify, and delete issues and projects across all other workspaces by substituting resource UUIDs in API requests. Additionally, any workspace member can self-promote to owner, remove the original owner, and gain sole control of any workspace they belong to — with no recovery mechanism available to the evicted owner. The combined attack chain means a single low-privilege member invitation is sufficient to exfiltrate all platform data and permanently take over any targeted workspace (GitHub Advisory).

No public proof-of-concept exploit code beyond the detailed PoC included in the official security advisory is known, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires only a valid authenticated session (low privileges), no special configuration, and is exploitable over the network with low complexity. No EPSS score or CISA KEV catalog entry has been reported. The advisory credits researcher joshuaalwin as the reporter (GitHub Advisory, PraisonAI Advisory).

1. Register or obtain an account: Register as any user on the target PraisonAI Platform instance (POST /api/v1/auth/register) and obtain a bearer token. Membership in any single workspace is sufficient for the IDOR attack.
2. Create or join a workspace: Create an attacker-controlled workspace (POST /api/v1/workspaces/) to obtain a valid workspace_id that passes the route-layer membership check.
3. Enumerate target resource UUIDs: Discover or guess UUIDs of issues or projects in other workspaces (e.g., via prior access, information disclosure, or enumeration).
4. IDOR — Read cross-workspace data: Send a GET request using the attacker's own workspace_id in the URL but the victim's issue_id or project_id: GET /api/v1/workspaces/{ATK_WS}/issues/{VICTIM_ISSUE_ID}. The service layer performs a global PK lookup and returns the victim's data (HTTP 200).
5. IDOR — Modify or delete cross-workspace data: Send a PATCH or DELETE request with the same UUID substitution to tamper with or destroy the victim's issues or projects across workspace boundaries.
6. Privilege escalation — Gain member access to target workspace: If not already a member, obtain an invitation to the target workspace (social engineering or other means). Alternatively, the IDOR alone does not require target workspace membership.
7. Self-promote to owner: Once a member of the target workspace, send PATCH /api/v1/workspaces/{VICTIM_WS}/members/{ATK_USER_ID} with body {"role": "owner"} using the attacker's member-level token. The endpoint accepts this with HTTP 200.
8. Remove original owner: Send DELETE /api/v1/workspaces/{VICTIM_WS}/members/{VICTIM_USER_ID} with the attacker's (now owner-level) token. The original owner is evicted (HTTP 204) with no recovery path. (GitHub Advisory, PraisonAI Advisory)

• Network/API Logs: HTTP 200 responses to GET /api/v1/workspaces/{workspace_id}/issues/{issue_id} or .../projects/{project_id} where the workspace_id in the response body differs from the workspace_id in the request URL — indicating cross-workspace IDOR access.
• API Logs: PATCH /api/v1/workspaces/{workspace_id}/members/{user_id} requests from low-privilege member accounts resulting in role changes to "owner", especially where the requesting user and target user ID are the same (self-promotion).
• API Logs: DELETE /api/v1/workspaces/{workspace_id}/members/{user_id} requests from accounts that were recently added as members, particularly targeting the workspace owner's user ID.
• API Logs: Repeated cross-workspace resource access patterns — a single user token accessing issues or projects across multiple different workspace IDs in rapid succession.
• Application State: Workspace membership records showing a user with role: owner who was previously listed as role: member, or original owners no longer appearing in workspace member lists. (GitHub Advisory)

Upgrade praisonai-platform to version >= 0.1.4, which contains the patch for both authorization failures. If immediate upgrade is not possible, restrict API access to trusted users only and audit workspace membership and role changes. The advisory recommends three code-level fixes: (1) scope all service get()/update()/delete() methods to validate workspace_id ownership before returning resources; (2) pass workspace_id from route handlers to service methods; and (3) require min_role="owner" for all member management endpoints and add guards against self-promotion, upward escalation, and last-owner removal. Audit existing workspace access logs to identify any unauthorized cross-workspace access or privilege escalations that may have already occurred (GitHub Advisory, PraisonAI Advisory).