CVE-2026-47412: falha de alta gravidade em MervinPraison praisonai-platform
praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.1epss 0.5%
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. PraisonAI Platform version 0.1.4 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Produtos afetados
MervinPraison · praisonai-platformCVEs relacionadas — MervinPraison praisonai-platform
No mesmo produto, das mais perigosas para as menos.
CVE-2026-57147CRITICALpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgeryEPSS 0.8%CVE-2026-57148CRITICALpraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)EPSS 0.6%CVE-2026-47410CRITICALpraisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unsetEPSS 0.4%CVE-2026-48169HIGHPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform APIEPSS 0.4%CVE-2026-47418HIGHpraisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOREPSS 0.4%CVE-2026-47406HIGHpraisonai-platform: Dependency endpoints accept any issue_id and dep_id without workspace ownership check, cross-workspace issue linking + read + delete IDOREPSS 0.4%