CVE-2026-47407 MervinPraison CVE debrief

Who should care

Users of PraisonAI Platform version prior to 0.1.4 should be aware of this critical vulnerability and take immediate action to upgrade to version 0.1.4 or apply necessary patches. Additionally, administrators and security teams responsible for monitoring and protecting AI and machine learning systems should be vigilant about potential exploitation attempts.

Technical summary

The vulnerability exists due to insufficient access control in the PraisonAI Platform. Specifically, the `require_workspace_member` dependency does not properly validate the workspace_id of the requested resource, allowing attackers to access and modify resources across different workspaces. Furthermore, member-management routes have a default `min_role='member'` that is not enforced, enabling basic members to promote themselves to admin or owner, demote or remove other members, and delete the workspace.

Defensive priority

High

Recommended defensive actions

• Upgrade PraisonAI Platform to version 0.1.4 or later
• Implement additional access controls and monitoring to detect potential exploitation attempts
• Restrict access to sensitive resources and routes
• Regularly review and update access control policies and roles
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

CVE-2026-47407 is a critical vulnerability in PraisonAI Platform version prior to 0.1.4. The Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects them with a `require_workspace_member(workspace_id)` FastAPI dependency. However, this dependency only checks if the caller is a member of the workspace_id in the URL prefix, not the resource's own workspace_id. This allows an attacker to access and modify resources from other workspaces by manipulating the URL prefix and resource ID. The CVE record was published on 2026-07-21T17:17:09.363Z and was last modified on 2026-07-22T15:17:17.657Z. The NVD entry is currently Deferred. Evidence is limited, and defenders should verify affected scope and vendor guidance.

Official resources