CVE-2026-47413
A flaw in PraisonAI Platform allows a low‑privilege user to add any other user as an owner of a workspace, giving them full control over that workspace. The vulnerability exists in all versions before 0.1.4 and is fixed in 0.1.4.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
PraisonAI Platform users running versions earlier than 0.1.4, especially those who manage workspaces in the multi‑agent teams system.
Real-world impact
An attacker could add themselves or another account as a workspace owner, gaining unrestricted access to all workspace data and settings, and potentially disrupting or stealing sensitive information.
Why this severity
The CVSS score of 9.6 reflects that the attack can be performed over the network with low effort, requires only low privileges, needs no user interaction, changes the scope of the affected component, and results in high confidentiality and integrity impact.
What to do about it
- 01Upgrade PraisonAI Platform to version 0.1.4 or later.
- 02Restart the PraisonAI Platform service to apply the update.
NVD-referenced vendor advisory
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.