4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-2fjj-qqg8-fg7x

GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary

The issue create and update endpoints in praisonai-platform accept a project_id in the request body and persist it without validating that the project belongs to the URL workspace. A user who is a member of workspace W_B (and has no access to workspace W_A) can create issues that reference a project owned by W_A. Because ProjectService.get_stats() aggregates issues by project_id with no workspace constraint, those foreign issues are then counted in the victim's own legitimate view of their project statistics. This is a cross-tenant integrity violation reachable by an outsider.

This is distinct from the path-parameter IDOR family fixed in 0.1.4 (CVE-2026-47415, CVE-2026-47418, CVE-2026-47419). Those fixes scoped object references supplied in the URL path. This report concerns an object reference supplied in the request body at write time, which the 0.1.4 fixes did not cover.

Version 0.1.4 fixed a set of path-parameter IDORs by threading workspace_id into the service-layer lookups (get / update / delete) and by adding the helpers ensure_resource_in_workspace() and require_issue_in_workspace() in api/deps.py. Those helpers are applied to object references that arrive in the URL path. They are not applied to object references that arrive in the request body on create or update.

Details

api/routes/issues.py, create_issue passes the body's project_id straight through with no workspace validation:

@router.post("/", response_model=IssueResponse, status_code=201)
async def create_issue(workspace_id: str, body: IssueCreate,
                       user=Depends(require_workspace_member), session=Depends(get_db)):
    svc = IssueService(session)
    issue = await svc.create(
        workspace_id=workspace_id,
        title=body.title,
        creator_id=user.id,
        project_id=body.project_id,        # attacker-controlled, not validated against workspace_id
        ...
    )

Miggo Vulnerability Database

→

GHSA-2fjj-qqg8-fg7x

GHSA-2fjj-qqg8-fg7x:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
praisonai-platform	pip	< 0.1.8	0.1.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the vulnerability was based on the detailed description provided, which pointed to an authorization bypass in the praisonai-platform. The core of the issue is the lack of validation of the project_id in the issue creation and update endpoints. The provided description included code snippets of the vulnerable functions: create_issue and update_issue in api/routes/issues.py, and the corresponding create and update methods in services/issue_service.py. It also highlighted the get_stats function in services/project_service.py as the place where the data pollution becomes visible.

To confirm these findings and identify the exact function signatures, I attempted to locate the patch that fixed this vulnerability. Since no direct commit was provided, I used the information that the vulnerability was patched in version 0.1.8. By comparing the repository state before and after this version (approximated by comparing recent commits), I was able to pinpoint the exact changes made to fix the vulnerability. The changes confirmed that the vulnerable functions were indeed the ones mentioned in the description. The patch added validation logic to the API endpoints to ensure that the project_id and other related IDs belong to the correct workspace, and it also scoped the get_stats query to the workspace, thus providing a defense-in-depth fix. The identified vulnerable functions are the ones that would be present in a runtime profile when this vulnerability is exploited.

Vulnerable functions

praisonai_platform.api.routes.issues.create_issue

src/praisonai-platform/praisonai_platform/api/routes/issues.py

This function is the entry point for creating an issue. It accepts a `project_id` from the user without validating if that project belongs to the specified workspace. This allows an attacker to associate an issue with a project in a different workspace.

praisonai_platform.services.issue_service.IssueService.create

src/praisonai-platform/praisonai_platform/services/issue_service.py

This service method is responsible for creating the `Issue` database record. It trusts the `project_id` passed from the API layer and persists it, leading to the cross-workspace data association.

praisonai_platform.api.routes.issues.update_issue

src/praisonai-platform/praisonai_platform/api/routes/issues.py

This function allows a user to update an existing issue. An attacker can use this to change the `project_id` of an issue to a project in another workspace, again without validation.

praisonai_platform.services.issue_service.IssueService.update

src/praisonai-platform/praisonai_platform/services/issue_service.py

This service method updates the issue record in the database. It directly applies the new `project_id` provided by the API layer without any validation, allowing the issue to be moved to a project in another workspace.

praisonai_platform.services.project_service.ProjectService.get_stats

src/praisonai-platform/praisonai_platform/services/project_service.py

This function is used to retrieve project statistics. It was vulnerable because it aggregated issue counts based solely on the `project_id`, without considering the workspace. This caused it to include issues that were created in other workspaces but linked to the project, thus revealing the data pollution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary

Details

GHSA-2fjj-qqg8-fg7x:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

4.3

4.3

Basic Information

Basic Information

GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary

Details

Proof of concept

Impact

Suggested fix

4.3

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary

Details

GHSA-2fjj-qqg8-fg7x:

4.3

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Technical Details

4.3

4.3

Basic Information

Basic Information

GHSA-2fjj-qqg8-fg7x: praisonai-platform: Authorization Bypass Through User-Controlled Key

Summary

Details

Proof of concept

Impact

Suggested fix

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI