External risk intelligence

PraisonAI Platform Privilege Escalation via Workspace Member Injection

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-47413

The vulnerability exists in a web platform's API endpoint, specifically /workspaces/{workspace_id}/members. As a platform layer for multi-agent systems, such web applications and their API endpoints are commonly deployed as internet-facing services to facilitate remote access, collaboration, and external agent integrations.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The PraisonAI Platform has a critical vulnerability that allows a user with basic access to escalate their privileges, potentially adding unauthorized users as owners of a workspace. This could enable significant disruption or unauthorized control within the platform's multi-agent systems. The primary concern is confirming if this platform is in use and, if so, determining the extent of exposure.

Low-access users can gain owner privileges.
This impacts control and unauthorized access.
Confirm relevance and scope of exposure.

Attack Path

How an attacker could exploit the issue

An attacker with member access to a workspace can exploit this vulnerability. By sending a crafted request to the `POST /workspaces/{workspace_id}/members` endpoint, an attacker can inject any user, including their own, into a workspace with owner privileges. This allows the attacker to gain full control over the workspace, potentially leading to data compromise and unauthorized actions.

Requires member access to a workspace.
Triggers by adding a member via a specific API endpoint.
Risk: Privilege escalation and cross-tenant member injection.

Live Threat

Current exploitation, exposure, and threat context

A low-privilege user within a PraisonAI Platform workspace could escalate their permissions to administrator, allowing them to add or remove other users from that workspace, including granting owner privileges. This could affect workspace membership and potentially disrupt the operation of multi-agent teams reliant on specific member roles.

Workspace membership and roles.
Unauthorized member additions to workspaces.
Disruption of agent team operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The PraisonAI Platform team or the application owner is responsible for addressing this privilege escalation vulnerability. The first practical step is to identify all instances of the PraisonAI Platform, determine their reachability and business criticality, and locate the accountable owner for each deployment. Subsequently, a remediation plan should be developed based on the assessed risk.

Platform or application owners should handle this.
Verify workspace member access controls.
Plan phased remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the PraisonAI Platform?

PraisonAI Platform acts as the foundational layer that manages and coordinates multi-agent teams. It provides the infrastructure necessary to organize these autonomous agents, allowing users to build and scale collaborative workflows where different agents work together to complete tasks within defined digital workspaces.

How does CVE-2026-47413 impact security?

This vulnerability involves an Improper Privilege Management (CWE-269) and a Missing Authorization (CWE-862) flaw. Because the system fails to check if the person requesting an action has permission to modify workspace roles, a low-privilege user can abuse the member-addition process to grant themselves or others administrative owner rights, effectively bypassing the platform's intended access controls.

Can any user trigger this vulnerability?

No, an attacker must already have basic workspace member access to initiate the exploit. The flaw specifically resides in how the system handles membership addition requests; it does not allow anonymous, unauthenticated, or external users to gain entry from the outside without first being a part of a workspace.

Is my PraisonAI instance at risk?

Halo Surface Signal indicates that because this vulnerability exists within an API endpoint frequently used for remote collaboration, instances are often deployed as internet-facing services. If your deployment is accessible over the network to facilitate multi-agent integrations, it is more likely to be reachable by an attacker who has gained low-level membership access.

What is the first step to fix this?

You should verify your current version of the PraisonAI Platform. The maintainers released version 0.1.4 specifically to address this flaw. Prioritize auditing your existing workspace memberships to ensure no unauthorized users have been granted owner-level roles, then proceed with updating the software to the patched version as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.