CVE-2026-47412

High

Description

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member of the workspace can issue a single DELETE to wipe the entire workspace, including every project, issue, comment, agent, label, and member record (cascading via the foreign-key relationships). There is no owner-role gate, no confirmation token, no soft-delete window, no recovery path. PraisonAI Platform version 0.1.4 patches the issue.

SeverityHigh

CVSS8.1

Exploit probability—

ProductPraisonai-platform

PublishedJul 21, 2026

First seenJul 21, 2026

Weakness typeCWE-269Improper privilege management CWE-862Missing authorization

How to fix

Update

praisonai-platform0.1.4 or later

Affected products

Product	Affected versions	Fixed in
praisonai-platformPyPI	v < 0.1.4	0.1.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.