CVE-2026-47413: PraisonAI Platform Unauthorized Workspace Owner Privilege Escalation (CVSS 9.6)

Vulnerability Overview

CVE-2026-47413 is a critical privilege escalation vulnerability rooted in missing authorization controls (CWE-862) and improper privilege management (CWE-269) within the praisonai-platform Python package. The flaw exists in the workspace membership API: the POST /workspaces/{id}/members endpoint performs no authorization check before processing role assignments, allowing any authenticated workspace member — regardless of their current role — to promote arbitrary users to the workspace owner role. With a CVSS score of 9.6, the impact is severe: a low-privileged insider or a compromised account can silently seize full administrative control of any workspace on the platform.

Affected Software

• Package: praisonai-platform (distributed via pip)
• Affected versions: all releases prior to 0.1.4
• Vendor: pip ecosystem (PraisonAI project)

At the time of publication, no patched release has been confirmed. Organizations running praisonai-platform < 0.1.4 should treat all workspace membership as untrusted until a fix is applied or compensating controls are in place.

Exploitation Status

A public proof-of-concept is available, disclosed on 2026-06-01. This significantly lowers the bar for exploitation — any authenticated user with access to a workspace can weaponize the PoC with minimal technical skill. Defenders should assume active exploitation attempts are plausible and prioritize detection and response over patch availability.

Detection Coverage

Our detection engineering team has built query coverage across seven SIEM platforms targeting the specific API abuse pattern that characterizes exploitation of this vulnerability. The detection logic focuses on:

• Identifying POST requests to the /workspaces/*/members endpoint where the resulting role assignment is owner
• Flagging cases where the requesting principal does not already hold owner-level privileges in the target workspace
• Correlating rapid role escalation events, particularly where the promoter and promotee accounts show no prior ownership relationship

Coverage ships for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL). Each query is tuned to reduce false positives from legitimate administrative promotion events by anchoring on the authorization anomaly — a non-owner performing an owner-grant — rather than the endpoint hit alone.

Recommended Response

If this detection fires, treat it as a high-confidence privilege escalation incident. Immediately audit workspace membership logs for unauthorized owner grants, revoke suspect role assignments, and review all actions taken by the newly promoted account. Until a patch is available, consider restricting access to the workspace membership API at the network or reverse-proxy layer.

Full detection queries, playbook steps, and atomic test cases for CVE-2026-47413 are available on the df00tech detection page for CVE-2026-47413. Paid subscribers receive the complete purple team package including adversary emulation scripts and triage runbooks.