MEDIUM6.5PyPI
PYSEC-2026-2927· CVE-2026-47408, GHSA-27p4-pjqv-whgjpraisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
Modified: 7/13/2026
package
PyPI/praisonai-platform
pkg:pypi/praisonai-platform
HIGH8.1PyPI
PYSEC-2026-2928· CVE-2026-47406, GHSA-4x6r-9v57-3gqwpraisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
Modified: 7/13/2026
HIGH7.6PyPI
PYSEC-2026-2929· CVE-2026-47414, GHSA-5jx9-w35f-vp65praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2930· CVE-2026-47399, GHSA-6h6v-6m7w-7vxxPraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
Modified: 7/13/2026
HIGH8.3PyPI
PYSEC-2026-2931· CVE-2026-47419, GHSA-7p8g-6c6g-h9w7praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2932· CVE-2026-47418, GHSA-943m-6wx2-rc2jpraisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2933· CVE-2026-47417, GHSA-cp4f-5m9r-5jc2praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2934· CVE-2026-47412, GHSA-g8rr-7rj2-f627praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2935· CVE-2026-48169, GHSA-gv23-xrm3-8c62PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Modified: 7/13/2026
HIGH8.8PyPI
PYSEC-2026-2936· CVE-2026-47405, GHSA-h37g-4h4p-9x97PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
Modified: 7/13/2026
MEDIUM6.5PyPI
PYSEC-2026-2937· CVE-2026-47411, GHSA-rcmc-q9rj-4wmqpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
Modified: 7/13/2026
HIGH8.1PyPI
PYSEC-2026-2938· CVE-2026-47409, GHSA-w388-2392-px73praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role
Modified: 7/13/2026
HIGH8.3PyPI
PYSEC-2026-2939· CVE-2026-47415, GHSA-xwq8-frcg-77q8praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-3524· CVE-2026-57147, GHSA-cwj8-7gp2-ggcwpraisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-3525· CVE-2026-57148, GHSA-f38v-77qj-h4jqpraisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
Modified: 7/23/2026
HIGH8.1PyPI
PYSEC-2026-3526· CVE-2026-57121, GHSA-rh39-9c67-59mhPraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Modified: 7/23/2026
CRITICAL9.8PyPI
PYSEC-2026-479· CVE-2026-47410, GHSA-3qg8-5g3r-79v5praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Modified: 7/13/2026
CRITICAL9.6PyPI
PYSEC-2026-480· CVE-2026-47413, GHSA-8g2p-pqm3-fcfhpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Modified: 7/1/2026
CRITICAL9.6PyPI
PYSEC-2026-481· CVE-2026-47416, GHSA-c2m8-4gcg-v22gpraisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Modified: 7/13/2026
—PyPI
PYSEC-2026-482· CVE-2026-47407, GHSA-h8q5-cp56-rr65PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-27p4-pjqv-whgj· CVE-2026-47408, PYSEC-2026-2927praisonai-platform: list_issue_activity returns activity log for any issue regardless of workspace ownership
Modified: 7/13/2026
MEDIUM4.3PyPI
GHSA-2fjj-qqg8-fg7x· CVE-2026-58653praisonai-platform: Authorization Bypass Through User-Controlled Key
Modified: 7/8/2026
CRITICAL9.8PyPI
GHSA-3qg8-5g3r-79v5· CVE-2026-47410, PYSEC-2026-479praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
Modified: 6/29/2026
HIGH8.1PyPI
GHSA-4x6r-9v57-3gqw· CVE-2026-47406, PYSEC-2026-2928praisonai-platform: IDOR in dependency endpoints allows cross-workspace issue linking, reading, and deletion due to missing ownership checks
Modified: 7/13/2026
HIGH7.6PyPI
GHSA-5jx9-w35f-vp65· CVE-2026-47414, PYSEC-2026-2929praisonai-platform: Label endpoints' unchecked label_id/issue_id enable cross-workspace label IDOR (edit, delete, link)
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-6h6v-6m7w-7vxx· CVE-2026-47399, PYSEC-2026-2930PraisonAI Platform workspace-scoped routes allow cross-workspace object access by global object ID
Modified: 7/13/2026
HIGH8.3PyPI
GHSA-7p8g-6c6g-h9w7· CVE-2026-47419, PYSEC-2026-2931praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026
CRITICAL9.6PyPI
GHSA-8g2p-pqm3-fcfh· CVE-2026-47413, PYSEC-2026-480praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
Modified: 6/29/2026
HIGH8.1PyPI
GHSA-943m-6wx2-rc2j· CVE-2026-47418, PYSEC-2026-2932praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026
CRITICAL9.6PyPI
GHSA-c2m8-4gcg-v22g· CVE-2026-47416, PYSEC-2026-481praisonai-platform: Any workspace member can promote themselves or others to owner via PATCH /workspaces/{id}/members/{user_id}
Modified: 6/29/2026
HIGH8.1PyPI
GHSA-cp4f-5m9r-5jc2· CVE-2026-47417, PYSEC-2026-2933praisonai-platform: Comment endpoints accept any issue_id without workspace ownership check, cross-workspace comment read and post IDOR
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-cwj8-7gp2-ggcw· CVE-2026-57147, PYSEC-2026-3524praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
Modified: 7/23/2026
CRITICAL9.8PyPI
GHSA-f38v-77qj-h4jq· CVE-2026-57148, PYSEC-2026-3525praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
Modified: 7/23/2026
HIGH8.1PyPI
GHSA-g8rr-7rj2-f627· CVE-2026-47412, PYSEC-2026-2934praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}
Modified: 7/13/2026
HIGH8.8PyPI
GHSA-gv23-xrm3-8c62· CVE-2026-48169, PYSEC-2026-2935PraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API
Modified: 8/7/2026
HIGH8.8PyPI
GHSA-h37g-4h4p-9x97· CVE-2026-47405, PYSEC-2026-2936PraisonAI Platform: Missing role checks let any workspace member become owner and control workspace membership
Modified: 7/13/2026
CRITICALPyPI
GHSA-h8q5-cp56-rr65· CVE-2026-47407, PYSEC-2026-482PraisonAI Platform has a cross-workspace IDOR + member-role privilege escalation
Modified: 6/29/2026
MEDIUM6.5PyPI
GHSA-rcmc-q9rj-4wmq· CVE-2026-47411, PYSEC-2026-2937praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}
Modified: 7/13/2026
HIGH8.1PyPI
GHSA-rh39-9c67-59mh· CVE-2026-57121, PYSEC-2026-3526PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
Modified: 7/23/2026
HIGH8.1PyPI
GHSA-w388-2392-px73· CVE-2026-47409, PYSEC-2026-2938praisonai-platform: Missing authorization on member removal enables full workspace takeover by any user regardless of role
Modified: 7/13/2026
HIGH8.3PyPI
GHSA-xwq8-frcg-77q8· CVE-2026-47415, PYSEC-2026-2939praisonai-platform: Issue endpoints accept any issue_id without workspace ownership check, cross-workspace read/update/delete IDOR
Modified: 7/13/2026