CVE-2026-47414 | CyberRota

CyberRota Analysis

AI-Generated

The PraisonAI Platform versions prior to 0.1.4 are vulnerable to an Insecure Direct Object Reference, allowing unauthorized access to label management endpoints by manipulating URL parameters. This flaw could enable attackers to access or modify labels across different workspaces without proper authorization, potentially leading to data leakage or integrity issues. Organizations using affected versions should prioritize upgrading to version 0.1.4 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE

CVE-2026-47414

Severity

HIGH

CVSS

7.6

EPSS

0.21%

Original NVD Description

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five label endpoints — `PATCH /workspaces/{workspace_id}/labels/{label_id}`, `DELETE .../labels/{label_id}`, `POST .../issues/{issue_id}/labels/{label_id}`, `DELETE .../issues/{issue_id}/labels/{label_id}`, `GET .../issues/{issue_id}/labels` — gate access on `require_workspace_member(workspace_id)` only and pass URL-supplied `label_id` and `issue_id` straight through to `LabelService` without verifying either belongs to the workspace. PraisonAI Platform version 0.1.4 patches the issue.