Detections
Analytics

SCA: security update for praisonai-platform (GHSA-h37g-4h4p-9x97)

high Tenable Cloud Security Plugin ID 442497

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to
 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace
 member to escalate their own role to `owner`. The issue is caused by privileged workspace-management
 routes using the shared dependency `require_workspace_member(...)` without requiring `admin` or `owner`.
 The dependency defaults to `min_role="member"`, so routes that should be administrative are accessible to
 ordinary workspace members. As a result, a normal workspace member can promote their own account from
 `member` to `owner`; add arbitrary users as `owner` or `admin`; change other members' roles; remove
 legitimate owners or members; take over workspace membership completely; and/or perform destructive
 workspace operations after escalation. This is a broken access control / vertical privilege escalation
 vulnerability. PraisonAI Platform version 0.1.4 patches the issue. (CVE-2026-47405)

Solution

Update the praisonai-platform library and its related packages to version 0.1.4 or later.

See Also

https://github.com/advisories/GHSA-h37g-4h4p-9x97

Plugin Details

Severity: High

ID: 442497

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/30/2026

Updated: 7/22/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.93

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-47405

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/29/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-47405