{"data":{"id":"390c1d54-02b3-4745-831a-3db12fe3aeb2","title":"GHSA-7p8g-6c6g-h9w7: praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR","summary":"The agent CRUD endpoints in praisonai-platform (GET, PATCH and DELETE on /workspaces/{workspace_id}/agents/{agent_id}) check only that the caller belongs to the workspace in the URL. AgentService.get resolves agent_id by primary key with no workspace_id predicate, so a member of one workspace can read, modify or delete agents in another workspace by supplying that agent's UUID. The flaw is an Insecure Direct Object Reference, tracked as GHSA-7p8g-6c6g-h9w7.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-7p8g-6c6g-h9w7","publishedAt":"2026-06-05T16:28:32.000Z","cveId":"CVE-2026-47419","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["praisonai-platform@< 0.1.4 (fixed: 0.1.4)"],"affectedPackageNames":["praisonai-platform"],"affectedPackageRefs":["pypi:praisonai-platform"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00345,"epssCheckedAt":"2026-11-05T00:11:43.744Z","kevDateAdded":null,"advisoryAliases":["GHSA-7p8g-6c6g-h9w7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-05T16:28:32.000Z","fixReleasedAt":"2026-05-19T06:22:58.188Z","daysToFix":-17,"fixCheckedAt":"2026-10-29T21:34:57.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"praisonai-platform","fixedVersion":"0.1.4","matchedVersion":"0.1.4","fixReleasedAt":"2026-05-19T06:22:58.188Z","daysToFix":-17,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:56.853Z"}]}}