{
  "affected": [
    {
      "affectedData": [
        {
          "product": "praisonai-platform",
          "vendor": "MervinPraison",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.1.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/projects/{project_id}` and `GET .../{project_id}/stats`) gate access on `require_workspace_member(workspace_id)` only, then resolve `project_id` through `ProjectService.get(project_id)` / `update(project_id, ...)` / `delete(project_id)` / `get_stats(project_id)`. None of these calls thread `workspace_id` through to constrain the lookup. A user who is a member of any workspace `W1` can read, modify, delete, or read stats for projects that belong to a different workspace `W2`. PraisonAI Platform version 0.1.4 patches the issue."
    }
  ],
  "id": "CVE-2026-47418",
  "lastModified": "2026-07-22T19:17:05.527",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-47418",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-22T18:06:37.814270Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-21T18:17:00.853",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/commit/ef79b7a0561796ad9807f0f09538c25cc78d3619"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/pull/1685"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-943m-6wx2-rc2j"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-943m-6wx2-rc2j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-01T14:17:04Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n**Type:** Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/projects/{project_id}` and `GET .../{project_id}/stats`) gate access on `require_workspace_member(workspace_id)` only, then resolve `project_id` through `ProjectService.get(project_id)` / `update(project_id, ...)` / `delete(project_id)` / `get_stats(project_id)`. None of these calls thread `workspace_id` through to constrain the lookup. A user who is a member of any workspace `W1` can read, modify, delete, or read stats for projects that belong to a different workspace `W2`.\n**File:** `src/praisonai-platform/praisonai_platform/services/project_service.py`, lines 47-108; route handlers at `src/praisonai-platform/praisonai_platform/api/routes/projects.py`, lines 51-108.\n**Root cause:** identical to the agent and issue IDORs in this codebase. The route accepts `workspace_id` from URL, uses it solely for the membership gate, then calls `ProjectService.get(project_id)` which is `session.get(Project, project_id)` \u2014 a primary-key-only lookup with no `workspace_id` predicate. `update` and `delete` call `self.get(project_id)` first, inheriting the gap. `get_stats` likewise has no workspace check.\n\n## Affected Code\n\n**File 1:** `src/praisonai-platform/praisonai_platform/services/project_service.py`, lines 47-108.\n\n```python\nclass ProjectService:\n    ...\n\n    async def get(self, project_id: str) -\u003e Optional[Project]:\n        \"\"\"Get project by ID.\"\"\"\n        return await self._session.get(Project, project_id)         # \u003c-- BUG: no workspace_id predicate\n\n    async def update(\n        self,\n        project_id: str,\n        ...\n    ) -\u003e Optional[Project]:\n        project = await self.get(project_id)                        # \u003c-- inherits the gap\n        ...\n\n    async def delete(self, project_id: str) -\u003e bool:\n        project = await self.get(project_id)                        # \u003c-- inherits the gap\n        ...\n\n    async def get_stats(self, project_id: str) -\u003e dict:\n        ...                                                          # \u003c-- also no workspace check; returns issue counts for any project\n```\n\n**File 2:** `src/praisonai-platform/praisonai_platform/api/routes/projects.py`, lines 51-108.\n\n```python\n@router.get(\"/{project_id}\", response_model=ProjectResponse)\nasync def get_project(\n    workspace_id: str,\n    project_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),\n    session: AsyncSession = Depends(get_db),\n):\n    svc = ProjectService(session)\n    project = await svc.get(project_id)                             # \u003c-- workspace_id never threaded through\n    if project is None:\n        raise HTTPException(status_code=404, detail=\"Project not found\")\n    return ProjectResponse.model_validate(project)\n\n\n@router.patch(\"/{project_id}\", response_model=ProjectResponse)\nasync def update_project(...):\n    svc = ProjectService(session)\n    project = await svc.update(project_id, title=body.title, ...)   # \u003c-- writes to any project in the DB\n\n@router.delete(\"/{project_id}\", ...)\nasync def delete_project(...):\n    deleted = await svc.delete(project_id)                          # \u003c-- deletes any project in the DB\n\n@router.get(\"/{project_id}/stats\")\nasync def project_stats(...):\n    return await svc.get_stats(project_id)                          # \u003c-- returns stats for any project in the DB\n```\n\n**Why it\u0027s wrong:** `workspace_id` from the route is treated as a UI hint (gates \"are you in some workspace W?\") rather than an authoritative predicate (should also gate \"is the project you are addressing actually inside W?\"). The `MemberService` in this same codebase uses a composite `(workspace_id, user_id)` key and demonstrates the safe pattern; the project service simply did not apply it.\n\n## Exploit Chain\n\n1. Attacker registers a workspace `W_attacker` (where they are a member) and harvests a target project UUID `P_T`. Project IDs leak through the activity feed (`act_svc.log` records `entity_id`), issue records (every issue carries `project_id`), webhook payloads, error messages, exported issue dumps, or operator screenshots. State: attacker holds `P_T`.\n2. Attacker authenticates and sends `GET /workspaces/W_attacker/projects/P_T`. `require_workspace_member(W_attacker, attacker)` passes. State: control flow enters `get_project` with `workspace_id=W_attacker, project_id=P_T`.\n3. `ProjectService.get(P_T)` runs `session.get(Project, \"P_T\")`, which is `SELECT * FROM projects WHERE id = \u0027P_T\u0027 LIMIT 1` with no `workspace_id` filter. The row is returned: `title`, `description` (often the project\u0027s confidential roadmap), `status`, `lead_type`, `lead_id`, `icon`, `created_at`, `workspace_id` (the foreign workspace\u0027s UUID is itself disclosed). State: response body is the JSON-serialised foreign project.\n4. Attacker repeats with `PATCH /workspaces/W_attacker/projects/P_T` and `{\"title\": \"\u003creset\u003e\", \"description\": \"\u003cwiped\u003e\", \"status\": \"archived\"}`. `update_project` calls `svc.update(P_T, ...)` and mutates the foreign row. State: target project is silently re-titled, re-described, and archived.\n5. Attacker calls `DELETE /workspaces/W_attacker/projects/P_T` to delete the foreign project entirely. State: target project is gone (every issue still referencing it now has a dangling `project_id`).\n6. Attacker calls `GET /workspaces/W_attacker/projects/P_T/stats` to read aggregate issue counts (open/closed/in-progress) for the foreign project \u2014 useful for competitive intelligence even when full-issue read is not possible.\n7. Final state: any attacker with one workspace-member token can enumerate, exfiltrate, rewrite, and delete every project in the multi-tenant deployment given the project UUIDs.\n\n## Security Impact\n\n**Severity:** sec-high. CVSS: network attack, low complexity, low privileges, no user interaction, scope unchanged, high confidentiality (project content + cross-workspace metadata via the leaked `workspace_id` field), high integrity (arbitrary writes / deletes), no availability claim (issue rows survive parent-project deletion).\n**Attacker capability:** read, edit, archive, delete, and stats-fingerprint any project in the multi-tenant deployment given the project UUID. Beyond plain content disclosure, the response also includes `workspace_id`, allowing the attacker to map the deployment\u0027s workspace topology (which workspaces exist, which projects each owns).\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; the attacker has any membership token; the target project\u0027s UUID is known or guessable.\n**Differential:** source-inspection-verified end-to-end. The asymmetry between `ProjectService.get(project_id)` (no workspace check) and `MemberService.get(workspace_id, user_id)` (composite key check) confirms the gap. With the suggested fix below, `ProjectService.get(workspace_id, project_id)` returns `None` for foreign-workspace projects and the route handler returns 404.\n\n## Suggested Fix\n\nSame shape as the companion agent and issue advisories. Make the resource-lookup query include the workspace predicate; treat foreign-workspace rows as 404.\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/services/project_service.py\n+++ b/src/praisonai-platform/praisonai_platform/services/project_service.py\n@@ -45,9 +45,12 @@ class ProjectService:\n         await self._session.flush()\n         return project\n\n-    async def get(self, project_id: str) -\u003e Optional[Project]:\n-        \"\"\"Get project by ID.\"\"\"\n-        return await self._session.get(Project, project_id)\n+    async def get(self, workspace_id: str, project_id: str) -\u003e Optional[Project]:\n+        \"\"\"Get project by ID, scoped to a workspace.\"\"\"\n+        stmt = select(Project).where(\n+            Project.id == project_id, Project.workspace_id == workspace_id\n+        )\n+        return (await self._session.execute(stmt)).scalar_one_or_none()\n\n     async def update(\n         self,\n+        workspace_id: str,\n         project_id: str,\n         ...\n     ) -\u003e Optional[Project]:\n-        project = await self.get(project_id)\n+        project = await self.get(workspace_id, project_id)\n\n-    async def delete(self, project_id: str) -\u003e bool:\n+    async def delete(self, workspace_id: str, project_id: str) -\u003e bool:\n-        project = await self.get(project_id)\n+        project = await self.get(workspace_id, project_id)\n\n-    async def get_stats(self, project_id: str) -\u003e dict:\n+    async def get_stats(self, workspace_id: str, project_id: str) -\u003e dict:\n+        # Also constrain the underlying issue counts query by workspace_id.\n```\n\nUpdate the route handlers in `routes/projects.py` to thread `workspace_id` through every call. The same single-key-lookup pattern is filed separately for `AgentService`, `IssueService`, `CommentService`, and `LabelService`.",
  "id": "GHSA-943m-6wx2-rc2j",
  "modified": "2026-06-01T14:17:04Z",
  "published": "2026-06-01T14:17:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-943m-6wx2-rc2j"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "praisonai-platform",
        "purl": "pkg:pypi/praisonai-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.1.1",
        "0.1.2",
        "0.1.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-47418",
    "GHSA-943m-6wx2-rc2j"
  ],
  "details": "## Summary\n\n**Type:** Insecure Direct Object Reference. The project CRUD endpoints (`GET / PATCH / DELETE /workspaces/{workspace_id}/projects/{project_id}` and `GET .../{project_id}/stats`) gate access on `require_workspace_member(workspace_id)` only, then resolve `project_id` through `ProjectService.get(project_id)` / `update(project_id, ...)` / `delete(project_id)` / `get_stats(project_id)`. None of these calls thread `workspace_id` through to constrain the lookup. A user who is a member of any workspace `W1` can read, modify, delete, or read stats for projects that belong to a different workspace `W2`.\n**File:** `src/praisonai-platform/praisonai_platform/services/project_service.py`, lines 47-108; route handlers at `src/praisonai-platform/praisonai_platform/api/routes/projects.py`, lines 51-108.\n**Root cause:** identical to the agent and issue IDORs in this codebase. The route accepts `workspace_id` from URL, uses it solely for the membership gate, then calls `ProjectService.get(project_id)` which is `session.get(Project, project_id)` \u2014 a primary-key-only lookup with no `workspace_id` predicate. `update` and `delete` call `self.get(project_id)` first, inheriting the gap. `get_stats` likewise has no workspace check.\n\n## Affected Code\n\n**File 1:** `src/praisonai-platform/praisonai_platform/services/project_service.py`, lines 47-108.\n\n```python\nclass ProjectService:\n    ...\n\n    async def get(self, project_id: str) -\u003e Optional[Project]:\n        \"\"\"Get project by ID.\"\"\"\n        return await self._session.get(Project, project_id)         # \u003c-- BUG: no workspace_id predicate\n\n    async def update(\n        self,\n        project_id: str,\n        ...\n    ) -\u003e Optional[Project]:\n        project = await self.get(project_id)                        # \u003c-- inherits the gap\n        ...\n\n    async def delete(self, project_id: str) -\u003e bool:\n        project = await self.get(project_id)                        # \u003c-- inherits the gap\n        ...\n\n    async def get_stats(self, project_id: str) -\u003e dict:\n        ...                                                          # \u003c-- also no workspace check; returns issue counts for any project\n```\n\n**File 2:** `src/praisonai-platform/praisonai_platform/api/routes/projects.py`, lines 51-108.\n\n```python\n@router.get(\"/{project_id}\", response_model=ProjectResponse)\nasync def get_project(\n    workspace_id: str,\n    project_id: str,\n    user: AuthIdentity = Depends(require_workspace_member),\n    session: AsyncSession = Depends(get_db),\n):\n    svc = ProjectService(session)\n    project = await svc.get(project_id)                             # \u003c-- workspace_id never threaded through\n    if project is None:\n        raise HTTPException(status_code=404, detail=\"Project not found\")\n    return ProjectResponse.model_validate(project)\n\n\n@router.patch(\"/{project_id}\", response_model=ProjectResponse)\nasync def update_project(...):\n    svc = ProjectService(session)\n    project = await svc.update(project_id, title=body.title, ...)   # \u003c-- writes to any project in the DB\n\n@router.delete(\"/{project_id}\", ...)\nasync def delete_project(...):\n    deleted = await svc.delete(project_id)                          # \u003c-- deletes any project in the DB\n\n@router.get(\"/{project_id}/stats\")\nasync def project_stats(...):\n    return await svc.get_stats(project_id)                          # \u003c-- returns stats for any project in the DB\n```\n\n**Why it\u0027s wrong:** `workspace_id` from the route is treated as a UI hint (gates \"are you in some workspace W?\") rather than an authoritative predicate (should also gate \"is the project you are addressing actually inside W?\"). The `MemberService` in this same codebase uses a composite `(workspace_id, user_id)` key and demonstrates the safe pattern; the project service simply did not apply it.\n\n## Exploit Chain\n\n1. Attacker registers a workspace `W_attacker` (where they are a member) and harvests a target project UUID `P_T`. Project IDs leak through the activity feed (`act_svc.log` records `entity_id`), issue records (every issue carries `project_id`), webhook payloads, error messages, exported issue dumps, or operator screenshots. State: attacker holds `P_T`.\n2. Attacker authenticates and sends `GET /workspaces/W_attacker/projects/P_T`. `require_workspace_member(W_attacker, attacker)` passes. State: control flow enters `get_project` with `workspace_id=W_attacker, project_id=P_T`.\n3. `ProjectService.get(P_T)` runs `session.get(Project, \"P_T\")`, which is `SELECT * FROM projects WHERE id = \u0027P_T\u0027 LIMIT 1` with no `workspace_id` filter. The row is returned: `title`, `description` (often the project\u0027s confidential roadmap), `status`, `lead_type`, `lead_id`, `icon`, `created_at`, `workspace_id` (the foreign workspace\u0027s UUID is itself disclosed). State: response body is the JSON-serialised foreign project.\n4. Attacker repeats with `PATCH /workspaces/W_attacker/projects/P_T` and `{\"title\": \"\u003creset\u003e\", \"description\": \"\u003cwiped\u003e\", \"status\": \"archived\"}`. `update_project` calls `svc.update(P_T, ...)` and mutates the foreign row. State: target project is silently re-titled, re-described, and archived.\n5. Attacker calls `DELETE /workspaces/W_attacker/projects/P_T` to delete the foreign project entirely. State: target project is gone (every issue still referencing it now has a dangling `project_id`).\n6. Attacker calls `GET /workspaces/W_attacker/projects/P_T/stats` to read aggregate issue counts (open/closed/in-progress) for the foreign project \u2014 useful for competitive intelligence even when full-issue read is not possible.\n7. Final state: any attacker with one workspace-member token can enumerate, exfiltrate, rewrite, and delete every project in the multi-tenant deployment given the project UUIDs.\n\n## Security Impact\n\n**Severity:** sec-high. CVSS: network attack, low complexity, low privileges, no user interaction, scope unchanged, high confidentiality (project content + cross-workspace metadata via the leaked `workspace_id` field), high integrity (arbitrary writes / deletes), no availability claim (issue rows survive parent-project deletion).\n**Attacker capability:** read, edit, archive, delete, and stats-fingerprint any project in the multi-tenant deployment given the project UUID. Beyond plain content disclosure, the response also includes `workspace_id`, allowing the attacker to map the deployment\u0027s workspace topology (which workspaces exist, which projects each owns).\n**Preconditions:** `praisonai-platform` is deployed multi-tenant; the attacker has any membership token; the target project\u0027s UUID is known or guessable.\n**Differential:** source-inspection-verified end-to-end. The asymmetry between `ProjectService.get(project_id)` (no workspace check) and `MemberService.get(workspace_id, user_id)` (composite key check) confirms the gap. With the suggested fix below, `ProjectService.get(workspace_id, project_id)` returns `None` for foreign-workspace projects and the route handler returns 404.\n\n## Suggested Fix\n\nSame shape as the companion agent and issue advisories. Make the resource-lookup query include the workspace predicate; treat foreign-workspace rows as 404.\n\n```diff\n--- a/src/praisonai-platform/praisonai_platform/services/project_service.py\n+++ b/src/praisonai-platform/praisonai_platform/services/project_service.py\n@@ -45,9 +45,12 @@ class ProjectService:\n         await self._session.flush()\n         return project\n\n-    async def get(self, project_id: str) -\u003e Optional[Project]:\n-        \"\"\"Get project by ID.\"\"\"\n-        return await self._session.get(Project, project_id)\n+    async def get(self, workspace_id: str, project_id: str) -\u003e Optional[Project]:\n+        \"\"\"Get project by ID, scoped to a workspace.\"\"\"\n+        stmt = select(Project).where(\n+            Project.id == project_id, Project.workspace_id == workspace_id\n+        )\n+        return (await self._session.execute(stmt)).scalar_one_or_none()\n\n     async def update(\n         self,\n+        workspace_id: str,\n         project_id: str,\n         ...\n     ) -\u003e Optional[Project]:\n-        project = await self.get(project_id)\n+        project = await self.get(workspace_id, project_id)\n\n-    async def delete(self, project_id: str) -\u003e bool:\n+    async def delete(self, workspace_id: str, project_id: str) -\u003e bool:\n-        project = await self.get(project_id)\n+        project = await self.get(workspace_id, project_id)\n\n-    async def get_stats(self, project_id: str) -\u003e dict:\n+    async def get_stats(self, workspace_id: str, project_id: str) -\u003e dict:\n+        # Also constrain the underlying issue counts query by workspace_id.\n```\n\nUpdate the route handlers in `routes/projects.py` to thread `workspace_id` through every call. The same single-key-lookup pattern is filed separately for `AgentService`, `IssueService`, `CommentService`, and `LabelService`.",
  "id": "PYSEC-2026-2932",
  "modified": "2026-07-13T16:05:37.953319Z",
  "published": "2026-07-13T15:35:23.385523Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-943m-6wx2-rc2j"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/praisonai-platform"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-943m-6wx2-rc2j"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47418"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR"
}