{"data":{"id":"dcefb1f7-f45e-43b9-a316-d25dc5a49222","title":"GHSA-rcmc-q9rj-4wmq: praisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}","summary":"The praisonai-platform PATCH /workspaces/{workspace_id} endpoint in workspaces.py is guarded by require_workspace_member, which defaults to min_role=\"member\". Any workspace member can therefore overwrite the workspace's name, description and free-form settings JSON through WorkspaceService.update(), without an owner-role check. Because the settings object is read by downstream code, an attacker could alter configuration such as provider URLs or invite behaviour, with a CVSS score of 6.5.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-rcmc-q9rj-4wmq","publishedAt":"2026-06-01T14:23:08.000Z","cveId":"CVE-2026-47411","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["praisonai-platform@< 0.1.4 (fixed: 0.1.4)"],"affectedPackageNames":["praisonai-platform"],"affectedPackageRefs":["pypi:praisonai-platform"],"affectedVendors":[],"affectedVendorsRaw":["PraisonAI","praisonai-platform"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00335,"epssCheckedAt":"2026-11-04T18:09:14.050Z","kevDateAdded":null,"advisoryAliases":["GHSA-rcmc-q9rj-4wmq"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-01T14:23:08.000Z","fixReleasedAt":"2026-05-19T06:22:58.188Z","daysToFix":-13,"fixCheckedAt":"2026-10-29T21:35:05.163Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["integrity"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"praisonai-platform","fixedVersion":"0.1.4","matchedVersion":"0.1.4","fixReleasedAt":"2026-05-19T06:22:58.188Z","daysToFix":-13,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:35:05.012Z"}]}}