Detections
Analytics

SCA: security update for praisonai-platform (GHSA-h8q5-cp56-rr65)

critical Tenable Cloud Security Plugin ID 442544

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version
 0.1.4, the Platform server exposes resources under `/api/v1/workspaces/{workspace_id}/...` and protects
 them with a `require_workspace_member(workspace_id)` FastAPI dependency. The dependency only checks that
 the caller is a member of the workspace_id in the URL prefix. The route handlers then look up the inner
 resource (`agent_id`, `issue_id`, `project_id`, `label_id`, `comment_id`, `dependency_id`) by primary key
 alone. The resource's own `workspace_id` is never compared to the URL's `workspace_id`. A user can
 therefore put their own workspace in the URL prefix and any other workspace's resource ID in the path. The
 auth check passes, since they really are a member of the prefix workspace. The service then returns the
 cross-tenant resource for read, update, or delete. There is a second bug in the member-management routes
 (`add_member`, `update_member_role`, `remove_member`, `update_workspace`, `delete_workspace`). Each one
 inherits the default `min_role="member"` from `require_workspace_member`. Any basic member can therefore
 promote themselves to admin or owner, demote or remove other members, and delete the workspace. The role
 hierarchy exists in the schema but is not enforced. Registration is open at `/api/v1/auth/register` with
 no email verification. The default server bind is `0.0.0.0:8000` (`python -m praisonai_platform`). One
 curl from any unauthenticated network position is enough to bootstrap into the system. PraisonAI Platform
 version 0.1.4 patches the issue. (CVE-2026-47407)

Solution

Update the praisonai-platform library and its related packages to version 0.1.4 or later.

See Also

https://github.com/advisories/GHSA-h8q5-cp56-rr65

Plugin Details

Severity: Critical

ID: 442544

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 5/30/2026

Updated: 7/22/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.93

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2026-47407

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 5/29/2026

Vulnerability Publication Date: 5/29/2026

Reference Information

CVE: CVE-2026-47407