{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.1.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47406"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-29T22:45:48Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n**Type:** Insecure Direct Object Reference. The dependency endpoints (`POST/GET /workspaces/{workspace_id}/issues/{issue_id}/dependencies` and `DELETE .../dependencies/{dep_id}`) gate access on `require_workspace_member(workspace_id)` only, then dispatch to `DependencyService` calls that take URL/body-supplied issue and dependency IDs without verifying any of them belong to the membership-checked workspace. Most damaging: `create_dependency` accepts `body.depends_on_issue_id` from the request body \u2014 that ID is checked against nothing \u2014 letting an attacker create a \"blocks\" or \"related\" link between any two issues anywhere in the database.\n**File:** `src/praisonai-platform/praisonai_platform/api/routes/dependencies.py`, lines 22-58; `services/dependency_service.py`, lines 26-65.\n**Root cause:** the same `Depends(require_workspace_member)` default-min-role pattern as the companion IDORs, plus a service layer (`DependencyService`) where every method takes raw IDs and queries them directly. `create(issue_id, depends_on_issue_id, ...)` writes a row with no workspace verification on either ID. `list_for_issue(issue_id)` returns dependencies in either direction. `delete(dep_id)` is a primary-key delete with no workspace predicate.\n\n## Affected Code\n\n**File 1:** `src/praisonai-platform/praisonai_platform/api/routes/dependencies.py`, lines 22-58.\n\n```python\n@router.post(\"/\", response_model=DependencyResponse, status_code=status.HTTP_201_CREATED)\nasync def create_dependency(\n    workspace_id: str,\n    issue_id: str,\n    body: DependencyCreate,\n    user: AuthIdentity = Depends(require_workspace_member),\n    session: AsyncSession = Depends(get_db),\n):\n    svc = DependencyService(session)\n    dep = await svc.create(issue_id, body.depends_on_issue_id, body.type)  # \u003c-- BUG: neither id is workspace-checked\n    return DependencyResponse.model_validate(dep)\n\n\n@router.get(\"/\", response_model=List[DependencyResponse])\nasync def list_dependencies(\n    workspace_id: str,\n    issue_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),\n    session: AsyncSession = Depends(get_db),\n):\n    svc = DependencyService(session)\n    deps = await svc.list_for_issue(issue_id)                              # \u003c-- BUG: returns dependencies for any issue\n    return [DependencyResponse.model_validate(d) for d in deps]\n\n\n@router.delete(\"/{dep_id}\", status_code=status.HTTP_204_NO_CONTENT)\nasync def delete_dependency(\n    workspace_id: str,\n    issue_id: str,\n    dep_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),\n    session: AsyncSession = Depends(get_db),\n):\n    svc = DependencyService(session)\n    deleted = await svc.delete(dep_id)                                     # \u003c-- BUG: deletes any dependency by id\n    if not deleted:\n        raise HTTPException(status_code=404, detail=\"Dependency not found\")\n```\n\n**File 2:** `src/praisonai-platform/praisonai_platform/services/dependency_service.py`, lines 26-65.\n\n```python\nasync def create(self, issue_id: str, depends_on_issue_id: str, dep_type: str = \"blocks\") -\u003e IssueDependency:\n    if dep_type not in VALID_TYPES:\n        raise ValueError(...)\n    dep = IssueDependency(\n        issue_id=issue_id,                                              # \u003c-- accepts any\n        depends_on_issue_id=depends_on_issue_id,                        # \u003c-- accepts any (from request body)\n        type=dep_type,\n    )\n    self._session.add(dep); await self._session.flush(); return dep\n\nasync def list_for_issue(self, issue_id: str) -\u003e list[IssueDependency]:\n    stmt = select(IssueDependency).where(\n        (IssueDependency.issue_id == issue_id) | (IssueDependency.depends_on_issue_id == issue_id)\n    )\n    return list((await self._session.execute(stmt)).scalars().all())\n\nasync def delete(self, dep_id: str) -\u003e bool:\n    dep = await self.get(dep_id)                                        # session.get(IssueDependency, dep_id) \u2014 no workspace check\n    ...\n```\n\n**Why it\u0027s wrong:** the request-body `depends_on_issue_id` is the worst part: an attacker can link any two issues across any two workspaces, polluting both workspaces\u0027 dependency graphs with attacker-chosen relationships (\"blocks\", \"blocked_by\", \"related\"). The triagers in the foreign workspace see their issue suddenly blocked by an unrelated foreign issue, breaking sprint planning and creating false correlation. The `delete(dep_id)` path lets an attacker remove legitimate cross-issue links between any two foreign workspaces, also disrupting their planning. The `list_for_issue` path leaks the dependency graph for any issue in the deployment.\n\n## Exploit Chain\n\n1. Attacker is a member of workspace `W_attacker` and harvests two foreign-workspace issue UUIDs `I1` (in `W_target1`) and `I2` (in `W_target2`). They leak via the activity feed, comment threads, error messages, exported dumps, the agent prompt history, or any other channel that ever serialises an issue ID. State: attacker holds two foreign issue UUIDs.\n2. Attacker sends `POST /workspaces/W_attacker/issues/I1/dependencies` with `Authorization: Bearer \u003cattacker_jwt\u003e` and body `{\"depends_on_issue_id\": \"I2\", \"type\": \"blocks\"}`. State: control flow enters `create_dependency` with `issue_id=I1` (foreign), `depends_on_issue_id=I2` (foreign).\n3. `require_workspace_member(W_attacker, attacker)` passes (attacker is a member of `W_attacker`). `DependencyService.create(I1, I2, \"blocks\")` writes a new row `IssueDependency(issue_id=I1, depends_on_issue_id=I2, type=\"blocks\")`. State: there is now a cross-workspace dependency between two foreign issues, written by the attacker.\n4. The triage UIs of `W_target1` and `W_target2` now show that the foreign issue is blocked by an unrelated issue in another workspace. Workflow rules that key off \"cannot close while blocked\" will refuse to let the legitimate triagers close `I1`. State: foreign workflow disrupted.\n5. Attacker repeats with `GET /workspaces/W_attacker/issues/I1/dependencies` to read the dependency graph for any foreign issue (information disclosure, project relationship mapping), or with `DELETE .../{dep_id}` (after enumerating dep_ids via the list call) to strip legitimate dependencies between foreign issues, breaking blocked-by chains.\n6. Final state: with one workspace-member token, the attacker reads, writes, and deletes dependencies on every issue in the multi-tenant deployment, polluting the dependency graphs of foreign workspaces.\n\n## Security Impact\n\n**Severity:** sec-high. CVSS 7.6: network attack, low complexity, low privileges, no user interaction, scope unchanged, high confidentiality (cross-workspace dependency graph disclosure), high integrity (cross-workspace dependency injection and deletion), no availability claim (workflow disruption is integrity, not availability).\n**Attacker capability:** read any issue\u0027s dependency graph; create arbitrary \"blocks\" / \"blocked_by\" / \"related\" links between any two issues across any two workspaces; delete any dependency by id. The most surprising primitive is the cross-workspace LINKING \u2014 the only one of the IDORs in this codebase where a single attacker request can affect TWO foreign workspaces at once.\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; attacker has any membership token; foreign issue UUIDs are reachable.\n**Differential:** source-inspection-verified end-to-end. The asymmetry between this service (no workspace predicate anywhere) and `MemberService.get(workspace_id, user_id)` (correctly composite-keyed) confirms the gap. With the suggested fix below, the route would resolve both the URL `issue_id` and the body `depends_on_issue_id` against `IssueService.get(workspace_id, ...)` before allowing the dependency to be written.\n\n## Suggested Fix\n\nResolve every issue id (URL and body) against `workspace_id` at the route layer before dispatching. The route helper from the issue-IDOR companion advisory can be reused.\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/api/routes/dependencies.py\n+++ b/src/praisonai-platform/praisonai_platform/api/routes/dependencies.py\n@@ -22,11 +22,16 @@\n @router.post(\"/\", response_model=DependencyResponse, status_code=status.HTTP_201_CREATED)\n async def create_dependency(\n     workspace_id: str,\n     issue_id: str,\n     body: DependencyCreate,\n     user: AuthIdentity = Depends(require_workspace_member),\n     session: AsyncSession = Depends(get_db),\n ):\n+    issue_svc = IssueService(session)\n+    if await issue_svc.get(workspace_id, issue_id) is None:\n+        raise HTTPException(status_code=404, detail=\"Issue not found\")\n+    if await issue_svc.get(workspace_id, body.depends_on_issue_id) is None:\n+        raise HTTPException(status_code=404, detail=\"depends_on_issue_id not found in this workspace\")\n     svc = DependencyService(session)\n     dep = await svc.create(issue_id, body.depends_on_issue_id, body.type)\n     return DependencyResponse.model_validate(dep)\n```\n\nApply the same `issue_svc.get(workspace_id, issue_id)` precondition to `list_dependencies` and `delete_dependency` (verifying both the issue and the dependency belong to `workspace_id`).",
  "id": "GHSA-4x6r-9v57-3gqw",
  "modified": "2026-05-29T22:45:48Z",
  "published": "2026-05-29T22:45:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4x6r-9v57-3gqw"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks"
}